Ensemble Techniques for Distributed Denial of Service<i> </i>Attack Detection: A Systematic Review

Abstract

Distributed Denial of Service (DDoS) attacks remain a major threat to modern network infrastructures, particularly in Cloud Computing, Software-Defined Networking (SDN), and Internet of Things (IoT) environments. To improve detection accuracy, robustness, and generalization, ensemble learning techniques have increasingly been adopted over single-model machine learning approaches. This study presents a systematic review of ensemble techniques for DDoS attack detection, with emphasis on ensemble architectures, datasets, and performance evaluation metrics. Using a PRISMA 2020-based methodology, 820 studies were retrieved from the IEEE Xplore database, screened, and narrowed to 60 relevant studies for qualitative synthesis. The findings reveal that Random Forest, boosting, stacking, and hybrid ensemble models dominate the literature due to their strong detection capabilities and high predictive performance. The review also shows a heavy reliance on benchmark datasets such as CICDDoS2019 and CICIDS2017, raising concerns regarding dataset bias and limited real-world generalizability. Furthermore, performance evaluation is largely centered on accuracy, while comprehensive metrics such as ROC-AUC and false positive rate are less frequently considered. The study recommends the adoption of diverse real-world datasets, cross-dataset validation strategies, standardized evaluation frameworks, and lightweight explainable ensemble models to improve scalability, interpretability, and practical deployment in modern cybersecurity environments.