Two-stage FWSC-based feature selection model for DDoS detection

Distributed Denial-of-Service (DDoS) attacks continue to threaten cloud-based infrastructures due to their scale, diversity, and rapidly evolving patterns. Despite their impressive detection capabilities, machine learning and deep learning models often rely on large, high-dimensional feature sets to be effective. These feature spaces may add redundancy, which impairs model generalization, and they also increase computational overhead. This study investigates whether a systematic feature selection strategy can reduce dimensionality while maintaining or improving detection performance. Experiments are conducted using the BCCC-cPacket-Cloud-DDoS-2024 dataset, which contains over 300 extracted flow-based features that represent both benign traffic and various DDoS scenarios. A two-stage optimization model is proposed. In the first stage, Fig Tree-Wasp Symbiotic Coevolutionary Optimization (FWSC) performs global exploration to remove irrelevant features. In the second stage, Particle Swarm Optimization (PSO) or Grey Wolf Optimization (GWO) refines the selected subset through localized search. A Deep Neural Network (DNN) is used for classification evaluation. Results show that the FWSC-PSO configuration reduces the original 306 features to 65, representing a 78.8% reduction, while achieving higher accuracy and F1-score than the baseline model that uses all features. Convergence behavior and feature-reduction progression are further examined through visualization, providing insight into the optimization dynamics. The findings suggest that combining global and local search strategies offers an effective approach for high-dimensional DDoS detection in cloud environments.