A Stacking-Based Ensemble Model for Multiclass DDoS Detection Using Shallow and Deep Machine Learning Algorithms

Eduardo Angulo, Leonardo Lizcano, Jose Marquez

Distributed Denial-of-Service (DDoS) attacks remain a significant threat to the stability and reliability of modern networked systems. This study presents a hierarchical stacking ensemble that integrates multiple Shallow Machine Learning (S-ML) and Deep Machine Learning (D-ML) algorithms for multiclass DDoS detection. The proposed architecture consists of three layers: Layer Zero (base learners), Layer One (meta learners), and Layer Two (final voting). The base layer combines heterogeneous S-ML and D-ML models, tree-based, kernel-based, and neural architectures, while the meta layer employs regression and neural models trained on meta-features derived from base-layer predictions. The final decision is determined through a voting mechanism that aggregates the outputs of the meta models. Using the CIC-DDoS2019 dataset with a nine-class configuration, the model achieves an accuracy of 91.26% and macro F1-scores above 0.90 across most attack categories. Unlike many prior works that report near-perfect performance under binary or reduced-class settings, our evaluation addresses a more demanding multiclass scenario with large-scale traffic (∼8.85 M flows) and a broad feature space. The results demonstrate that the ensemble provides competitive multiclass detection performance and consistent behavior across heterogeneous attack types, supporting its applicability to high-volume network monitoring environments.