Entropy-Guided Jaya optimization for robust feature selection in high-dimensional network attack detection

1 Introduction

Distributed Denial-of-Service (DDoS) attacks remain one of the most significant cybersecurity threats, disrupting network services by overwhelming computing and communication resources with malicious traffic. The rapid growth of cloud computing, Software-Defined Networking (SDN), the Internet of Things (IoT), and high-speed Internet infrastructures has increased both the scale and sophistication of DDoS attacks, making timely and accurate detection increasingly challenging Mirkovic and Reiher (2004); Stallings and Brown (2018); Ferrag et al. (2020). Modern DDoS attacks exploit diverse reflection and amplification techniques, including DNS, NTP, LDAP, MSSQL, SSDP, SNMP, NetBIOS, UDP, SYN, and TFTP, whose heterogeneous traffic characteristics often reduce the effectiveness of conventional intrusion detection approaches Sharafaldin et al. (2018).

Machine learning (ML)-based intrusion detection systems (IDSs) have demonstrated remarkable capability in learning complex attack patterns from large-scale network traffic Buczak and Guven (2015); Ferrag et al. (2020). Among the publicly available benchmark datasets, CIC-DDoS2019 has become one of the most widely adopted for evaluating ML-based DDoS detection methods because it contains realistic traffic traces and multiple reflection and flooding attacks Sharafaldin et al. (2019). However, the dataset includes numerous redundant, irrelevant, and highly correlated features that increase computational complexity, prolong model training, and may degrade classification performance. Consequently, feature selection has become an essential preprocessing step for developing accurate and computationally efficient IDSs.

The ACAFS framework highlights the importance of preserving discriminative features for minority attack classes in imbalanced intrusion detection datasets Mchina et al. (2026). Feature selection techniques are generally categorized into filter, wrapper, and embedded methods Chandrashekar and Sahin (2014). Filter methods rank features using statistical or information-theoretic criteria and are computationally efficient but generally ignore feature interactions. Wrapper methods evaluate candidate feature subsets using a predictive model and often achieve superior predictive performance at the expense of higher computational cost, whereas embedded methods perform feature selection during model construction. Hybrid filter–wrapper approaches have therefore attracted increasing attention because they combine efficient feature evaluation with classifier-guided optimization. In particular, entropy-based measures, including Shannon entropy, mutual information, and conditional entropy, have been widely employed to quantify feature uncertainty and relevance Shannon (1948); Bromiley et al. (2004); Vergara and Estévez (2014); Alabi and Yurtkan (2018); Hassan et al. (2024).

Metaheuristic optimization algorithms have shown considerable promise for wrapper-based feature selection because of their ability to efficiently explore large combinatorial search spaces. Among these algorithms, the parameter-free Jaya algorithm has gained widespread attention owing to its simplicity and competitive optimization capability Rao et al. (2016). Recent Binary Jaya variants have enhanced search performance through binary similarity measures, opposition-based learning, and improved search operators Chaudhuri and Sahu (2022); Abed-alguni and Al-Jarah (2024). Nevertheless, most existing Jaya-based feature selection methods rely on random population initialization without exploiting prior knowledge of feature relevance, which may slow convergence and increase the risk of premature convergence. Moreover, their application to high-dimensional multiclass cybersecurity datasets such as CIC-DDoS2019 remains limited. Another practical challenge is the accurate discrimination of highly overlapping attack categories, particularly SSDP and UDP attacks, whose similar flow-level characteristics make them difficult to distinguish using conventional feature selection methods.

To address these challenges, this paper proposes an Entropy-Guided Jaya (EGJ) algorithm for wrapper-based feature selection. The proposed framework introduces a novel Weighted Composite Entropy (WCE) measure that combines Shannon entropy and mutual information to guide Binary Jaya population initialization toward informative feature subsets. An adaptive mutation mechanism is incorporated to preserve population diversity and alleviate premature convergence, while XGBoost is employed as the wrapper classifier to evaluate candidate feature subsets. By integrating information-theoretic feature evaluation with adaptive Jaya optimization, the proposed framework aims to improve convergence efficiency, identify compact and discriminative feature subsets, and enhance multiclass DDoS detection performance.

The effectiveness of EGJ is validated on the CIC-DDoS2019 benchmark dataset and compared with recent Jaya-based feature selection approaches. Comprehensive experiments demonstrate that the proposed method improves feature subset quality, classification performance, convergence behavior, and computational efficiency while providing enhanced detection of challenging SSDP and UDP attack classes.

The major contributions of this work are summarized as follows:

• A novel Entropy-Guided Jaya (EGJ) wrapper feature selection algorithm is proposed by integrating a Weighted Composite Entropy (WCE) measure into Binary Jaya population initialization to improve convergence toward informative feature subsets.
• A Swish-based binary transfer function and an adaptive mutation strategy are incorporated to enhance exploration, preserve population diversity, and mitigate premature convergence during optimization.
• XGBoost is employed as the wrapper evaluator to optimize feature subsets for multiclass DDoS detection on the CIC-DDoS2019 dataset.
• Extensive experiments evaluate the proposed framework in terms of classification performance, computational efficiency, convergence characteristics, and its effectiveness in detecting challenging SSDP and UDP attacks.

The remainder of this article is organized as follows. Section 2 presents the background and related work on DDoS detection and feature selection techniques. Section 3 describes the proposed Entropy-Guided Jaya (EGJ) framework and its constituent methodologies. Section 4 presents the experimental setup, performance evaluation, and comparative analysis. Finally, Section 5 concludes the paper and outlines potential directions for future research.

2 Background and related work

This section reviews the background knowledge and related studies relevant to the proposed Entropy-Guided Jaya (EGJ) framework. It first outlines the characteristics and challenges of DDoS attacks, followed by an overview of the CIC-DDoS2019 dataset used for experimental evaluation. Subsequently, information-theoretic feature evaluation and Jaya-based feature selection methods are reviewed to identify the limitations of existing approaches and motivate the proposed framework.

2.1 DDoS attack model and detection challenges

Distributed Denial-of-Service (DDoS) attacks are among the most prevalent cyber threats targeting modern communication networks, cloud infrastructures, software-defined networks (SDNs), and Internet of Things (IoT) environments Bhatia et al. (2018). Unlike conventional denial-of-service attacks that originate from a single source, DDoS attacks coordinate a large number of compromised devices (bots) to simultaneously transmit malicious traffic toward a target system, exhausting network bandwidth, computational resources, or application services and thereby preventing legitimate users from accessing the service Mirkovic and Reiher (2004); Yu (2014); Stallings and Brown (2018).

Figure 1 illustrates the general architecture of a DDoS attack. An attacker communicates with one or more command-and-control (C&C) servers or handlers that coordinate a distributed botnet. Upon receiving attack instructions, the compromised hosts generate synchronized traffic toward the victim, producing an aggregate traffic volume that is difficult to mitigate using conventional security mechanisms. Depending on the attack vector, DDoS attacks may exploit protocol vulnerabilities, reflection and amplification techniques, or application-layer requests to maximize resource exhaustion while minimizing the attacker’s effort.

Recent DDoS attacks employ diverse strategies, including reflection/amplification attacks (e.g., DNS, NTP, LDAP, MSSQL, SNMP, SSDP, and NetBIOS), transport-layer flooding attacks (e.g., UDP and SYN floods), and application-layer attacks (e.g., HTTP floods). These attacks exhibit heterogeneous traffic characteristics and increasingly resemble legitimate communication patterns, making accurate multiclass classification challenging. Consequently, identifying a compact set of informative features is essential for improving detection performance while reducing computational complexity.

2.2 CIC-DDoS2019 dataset

The CIC-DDoS2019 dataset, developed by the Canadian Institute for Cybersecurity (CIC), is one of the most widely adopted benchmark datasets for evaluating machine learning-based DDoS detection systems because it contains realistic network traffic representing multiple contemporary attack scenarios Sharafaldin et al. (2019). Network flows are generated using CICFlowMeter and characterized by statistical attributes describing packet lengths, inter-arrival times, flow duration, packet rates, TCP flags, and header information.

The dataset comprises benign traffic together with twelve representative DDoS attack categories covering reflection/amplification attacks (DNS, NTP, LDAP, MSSQL, SNMP, SSDP, NetBIOS, and TFTP), transport-layer flooding attacks (UDP Flood, UDP-Lag, and SYN Flood), and application-layer attacks (WebDDoS). This diversity enables comprehensive evaluation of multiclass intrusion detection models under realistic operating conditions. Table 1 summarizes the attack categories included in the dataset together with their targeted services and typical real-world impact.

TABLE 1. Characteristics of DDoS attack categories represented in the CIC-DDoS2019 dataset.

Among these attacks, SSDP and UDP Flood remain particularly challenging because both employ UDP-based communication and exhibit similar flow-level characteristics, including short flow durations, high packet transmission rates, and bursty traffic patterns. Such similarities often lead to overlapping feature distributions, increasing the difficulty of discriminating between these attack classes. These characteristics make the CIC-DDoS2019 dataset an appropriate benchmark for evaluating advanced wrapper-based feature selection algorithms capable of identifying discriminative features while maintaining computational efficiency.

2.3 Information-theoretic feature evaluation

Feature selection plays a fundamental role in machine learning by identifying informative attributes while eliminating redundant and irrelevant features that may degrade classification performance. Among filter-based approaches, information-theoretic methods have been extensively employed because they quantify the uncertainty, relevance, and discriminative capability of features without relying on a specific learning algorithm Thomas and Joy (2006); Peng et al. (2005); Brown et al. (2012). These methods are computationally efficient and scalable, making them particularly suitable for high-dimensional cybersecurity datasets.

2.3.1 Shannon entropy

Shannon entropy measures the uncertainty or information content associated with a random variable. For a feature X, the entropy is defined as presented in Equation 1.

H X = − ∑ i = 1 n p x i log 2 p x i , (1)

where p ( x i ) denotes the probability of observing the i-th value of feature X. Features with higher entropy generally exhibit greater variability and contain richer information that may contribute to classification. However, entropy alone does not indicate whether the information is relevant to the target class.

2.3.2 Conditional entropy

Conditional entropy measures the remaining uncertainty of one variable after observing another. It is expressed as presented in Equation 2.where p ( x , y ) denotes the joint probability distribution of X and Y, and p ( y | x ) is the corresponding conditional probability. Smaller values of conditional entropy indicate that a feature provides stronger predictive information about the target class.

H Y | X = − ∑ x , y p x , y log 2 p y | x , (2)

2.3.3 Mutual information

Mutual Information (MI) quantifies the amount of information shared between a feature X and the class label Y, thereby measuring feature relevance. It is defined as presented in Equation 3.

I X ; Y = H X − H X | Y = H Y − H Y | X , (3)

where H ( X | Y ) and H ( Y | X ) represent conditional entropy. A larger MI value indicates that knowledge of the feature substantially reduces the uncertainty of the class labels, making the feature more informative for classification.

Collectively, Shannon entropy, mutual information, and conditional entropy provide complementary perspectives for evaluating feature quality. Shannon entropy measures feature variability, mutual information quantifies feature relevance, and conditional entropy reflects predictive uncertainty. Integrating these measures enables a more comprehensive assessment of feature importance than relying on any individual metric alone. This observation motivates the development of the Weighted Composite Entropy (WCE) measure presented in Section 3, where these complementary information-theoretic concepts are incorporated into the initialization stage of wrapper-based optimization.

2.4 Jaya-based feature selection

Metaheuristic optimization algorithms have become increasingly popular for wrapper-based feature selection because they efficiently explore large combinatorial search spaces while directly optimizing classifier performance. Among these approaches, the Jaya algorithm has attracted considerable attention due to its parameter-free optimization mechanism, conceptual simplicity, and competitive optimization capability Rao et al. (2016). Unlike population-based algorithms that require algorithm-specific parameters, Jaya iteratively updates candidate solutions by moving them toward the best solution while simultaneously avoiding the worst solution, thereby simplifying parameter tuning and improving robustness.

To address binary feature selection problems, several Binary Jaya variants have been proposed. These methods employ transfer functions to transform continuous candidate solutions into binary feature-selection masks and have demonstrated encouraging performance on benchmark optimization problems Chaudhuri and Sahu (2022). Subsequent studies introduced adaptive search strategies, elite learning, opposition-based learning, chaotic initialization, and hybrid optimization techniques to improve exploration and reduce premature convergence Zitar et al. (2022); Abed-alguni and Al-Jarah (2024).

More recently, Jaya-based feature selection has been successfully applied to network intrusion detection, where wrapper evaluation using machine learning classifiers enables the identification of compact feature subsets with improved predictive performance. Recent developments include multi-island evolutionary frameworks that improve scalability and population diversity by partitioning the search process into multiple interacting subpopulations. For example, the Memory-Efficient Multi-Island Jaya (MIJ) algorithm introduced D-optimal sampling and distributed island evolution to reduce memory consumption while improving convergence on the CIC-DDoS2019 dataset Singh and Khare (2026). Although MIJ demonstrated competitive detection performance and computational efficiency, its population initialization remained random and did not exploit prior information regarding feature relevance.

Table 2 compares representative Jaya-based feature selection methods with the proposed EGJ framework. Existing studies primarily improve search behaviour through hybridization, elite learning, or diversity-preserving strategies. However, few methods exploit prior information regarding feature relevance before optimization or incorporate information-theoretic guidance into population initialization. These observations motivate the proposed entropy-guided initialization strategy, which seeks to improve convergence speed and feature subset quality while preserving the simplicity of the original Jaya algorithm.

TABLE 2. Comparison of representative Jaya-based feature selection methods and the proposed EGJ framework.

2.5 Machine learnining based DDoS detection

Machine learning has become a widely adopted approach for DDoS detection because of its ability to automatically learn discriminative traffic patterns from large-scale network data. Traditional supervised learning algorithms, including Decision Trees (DT), Random Forests (RF), Support Vector Machines (SVM), k-Nearest Neighbors (k-NN), and Naïve Bayes (NB), have demonstrated promising detection performance on benchmark intrusion detection datasets Singh and Khare (2022), Singh and Khare (2021); Buczak and Guven (2015); Chandrashekar and Sahin (2014). More recently, ensemble learning methods, particularly XGBoost and LightGBM, have gained increasing attention owing to their robustness, scalability, and ability to model complex nonlinear relationships among traffic features Chen and Guestrin (2016); Ke et al. (2017); Gormez et al. (2020). Their effectiveness has made them attractive wrapper classifiers for feature selection, where classification performance directly guides the search for informative feature subsets. Deep learning approaches, including Deep Neural Networks (DNNs), Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), Long Short-Term Memory (LSTM) networks, and Autoencoders, have further improved DDoS detection by automatically learning hierarchical feature representations from network traffic Khare et al. (2020); ?); Ferrag et al. (2020); Aktar and Nur (2023). Despite achieving high detection accuracy, these methods generally require large training datasets, substantial computational resources, and extensive hyperparameter tuning, which may limit their deployment in real-time intrusion detection systems.

To reduce computational complexity while maintaining classification performance, recent studies have increasingly focused on feature selection. Filter methods based on entropy, mutual information, ReliefF, and correlation analysis efficiently eliminate irrelevant attributes but generally ignore interactions among features and classifier behaviour. Wrapper methods typically achieve higher predictive performance by directly optimizing classifier accuracy; however, they are computationally more expensive because each candidate subset requires classifier evaluation Chandrashekar and Sahin (2014). Consequently, hybrid filter–wrapper approaches have emerged as an effective compromise, combining the efficiency of filter methods with the predictive capability of wrapper-based optimization.

Recent Jaya-based feature selection algorithms have demonstrated encouraging performance in cybersecurity applications through adaptive learning, hybrid optimization, and population diversity preservation Zitar et al. (2022); Abed-alguni and Al-Jarah (2024); Albasheer et al. (2025); Yaseen et al. (2025). More recently, Singh et al. Singh and Khare (2026) proposed a Memory-Efficient Multi-Island Jaya (MIJ) framework that employed D-optimal initialization, distributed island evolution, and H2O AutoML-based wrapper evaluation to improve scalability and reduce memory requirements for high-dimensional DDoS detection. Despite these improvements, MIJ still relied on randomly generated binary populations and therefore did not incorporate information-theoretic feature relevance during initialization. Consequently, opportunities remain to further improve convergence speed and feature subset quality through entropy-guided optimization.

2.6 Research gap and motivation

Although considerable progress has been achieved in feature selection for network intrusion detection, several important limitations remain. First, most wrapper-based Jaya algorithms initialize candidate solutions randomly, without utilizing prior knowledge regarding feature relevance. Consequently, the optimization process may require additional iterations before converging toward informative feature subsets. Second, conventional binary transfer functions may gradually reduce population diversity during optimization, increasing the likelihood of premature convergence in high-dimensional search spaces. Third, existing approaches primarily optimize overall classification accuracy and often overlook minority or highly overlapping attack classes. In particular, SSDP and UDP Flood attacks exhibit similar flow-level characteristics because both rely on UDP communication, making them difficult to distinguish using conventional feature selection strategies.

Information-theoretic measures provide an effective mechanism for estimating feature uncertainty and class relevance before optimization. However, these measures are commonly employed as independent filter methods rather than being integrated into wrapper-based metaheuristic search. Combining entropy-guided feature evaluation with population-based optimization therefore offers the potential to improve convergence behaviour while preserving the predictive capability of wrapper feature selection.

Table 3 summarizes the major limitations identified from the literature and highlights how the proposed Entropy-Guided Jaya (EGJ) framework addresses these challenges.

TABLE 3. Research gap analysis and motivation for the proposed EGJ framework.

The above observations motivate the proposed Entropy-Guided Jaya (EGJ) framework presented in Section 3. By incorporating Weighted Composite Entropy (WCE) into population initialization, together with Swish-based binary mapping and adaptive mutation, the proposed approach seeks to improve convergence speed, preserve population diversity, identify compact feature subsets, and enhance the detection of challenging DDoS attack categories while maintaining the parameter-free simplicity of the original Jaya algorithm.

3 Materials and methods

This study introduces an EGJ DXGB based optimization framework aimed at feature selection. It begins by initializing a candidate using a binarized composite entropy mask and progresses by evolving the population through a Swish-binarized, mutation-enhanced Jaya update. This composite entropy integrates both marginal and conditional entropy, directing the search towards informative areas while maintaining diversity through adaptive mutation and random replacement. The selected features are assessed using XGBoost on the H2O platform. Experiments conducted on the CIC-DDoS 2019 dataset demonstrate a significant decrease in the number of features while achieving high recall and F1 score.

3.1 Dataset preprocessing

The proposed Entropy-Guided Jaya (EGJ) framework is evaluated using the CIC-DDoS2019 benchmark dataset. Nevertheless, the increased dimensionality of this network traffic dataset necessitates effective data pre-processing and feature selection methods. Prior to feature selection, the CIC-DDoS2019 dataset was preprocessed to improve data quality and reduce redundancy. The training and testing set records of CIC-DDoS2019 consist of 88 features, including one target feature ‘Label’. In this research, the focus is on the second-day attacks, which include benign traffic and specifically 8 types of attacks: DNS, LDAP, MSSQL, NTP, NetBIOS, SSDP, UDP, and Syn out of a total of 12 attacks. The preprocessing pipeline included the removal of non-informative attributes, duplicate records, and instances containing invalid or infinite values. Highly correlated features were subsequently eliminated to reduce multicollinearity, followed by random undersampling to construct a balanced multiclass dataset. The resulting dataset was then used as input to the proposed EGJ feature selection framework. The preprocessing procedure is based on our previous study Singh and Khare (2026) and is briefly summarized here for completeness. Table 4 summarizes the key characteristics of the CIC-DDoS2019 dataset used throughout this study, including the attack categories, feature extraction process, and the number of features retained after preprocessing. These characteristics provide the basis for evaluating the effectiveness and scalability of the proposed EGJ feature selection framework. Although the same benchmark dataset and preprocessing protocol are employed to ensure fair comparison with our previous work, the proposed EGJ framework constitutes a new feature selection methodology with a different optimization strategy, feature evaluation, and mechanism. Owing to its realistic traffic characteristics, multiple attack categories, and challenging multiclass classification setting, CIC-DDoS2019 provides an appropriate benchmark for evaluating the effectiveness, robustness, and scalability of the proposed Entropy-Guided Jaya (EGJ) feature selection framework.

TABLE 4. Summary of the CIC-DDoS2019 dataset used in this study.

3.2 Weighted composite entropy (WCE)

Neither Shannon entropy nor Mutual Information alone provides a complete assessment of feature quality. Shannon entropy quantifies the intrinsic information content and variability of a feature but does not account for its predictive relationship with the target classes. Consequently, a feature may exhibit high entropy because of substantial variability while contributing little to class discrimination. Conversely, Mutual Information measures the dependency between a feature and the class labels, effectively identifying features with strong predictive capability. However, it does not explicitly consider the inherent information content or diversity of the feature itself. To exploit the complementary strengths of these information-theoretic measures, the proposed Weighted Composite Entropy (WCE) integrates Shannon entropy and Mutual Information into a unified feature evaluation criterion. Shannon entropy encourages the selection of features with rich information content, whereas Mutual Information promotes features that are highly relevant to the classification task. By jointly considering these two measures, WCE prioritizes features that are both information-rich and highly discriminative, thereby providing a more balanced and reliable estimate of feature importance than either measure alone. A composite guided by mutual information can be expressed as presented in Equation 4:

W C E X , Y = α H X + β H Y − H Y | X (4)

Table 5 provides description of the parameters used in the proposed Weighted Composite Entropy (WCE) computation with weights α , β ∈ [ 0,1 ] that adjust the balance between marginal diversity and discriminative strength. Algorithm 1 reflects our implementation.

TABLE 5. Description of the parameters used in the proposed Weighted Composite Entropy (WCE) computation.

Algorithm 1. Weighted Composite Entropy (WCE).

3.2.1 Algorithm description

Given a feature vector X and target labels Y, the algorithm first converts continuous values into discrete intervals, because entropy and mutual information are defined for discrete probability distributions. To practically estimate continuous features, we discretize X using quantile discretization, while categorical Y is encoded with labels. It then computes:

• Shannon entropy of the feature H ( X ), which measures the uncertainty or information content of the feature.
• Conditional entropy H ( Y | X ), which measures the remaining uncertainty of the class labels after observing the feature.
• Mutual information which quantifies how much information the feature provides about the class labels.
• This algorithm computes the Weighted Composite Entropy (WCE) score for a single feature by combining its intrinsic information content (Shannon entropy) and class relevance (Mutual Information). The resulting score is used to rank features before initializing the Entropy-Guided Jaya (EGJ) algorithm.

3.2.2 Interpretation in the context of EGJ

For the proposed Entropy-Guided Jaya (EGJ) algorithm, features with higher WCE scores are considered more informative and are preferentially selected during the entropy-guided population initialization. By biasing the initial population toward these informative features, the optimization process starts from higher-quality candidate solutions, leading to faster convergence, improved feature subset quality, and enhanced multiclass DDoS detection performance.

3.3 Jaya algorithm

The Jaya algorithm is a population-based optimization technique that systematically enhances candidate solutions using update Equation 5, with the goal of converging on the best-known solution while avoiding the least favorable one.where:

P n e w = P c u r r e n t + r 1 P b e s t − | P c u r r e n t | − r 2 P w o r s t − | P c u r r e n t | (5)

• P current is the current solution.
• P best is the best solution in the current population
• P worst is the worst solution in the current population
• r 1 and r 2 are random numbers in [ 0,1 ].

Below are the steps to implement the Jaya Optimization to identify optimized hyperparameters:

• Select a dataset to serve as input. Divide the dataset into training and testing sets.
• Identify the hyperparameters of the classifier that require optimization (for instance, the number of trees, maximum depth, minimum rows, and sample rate). Establish the objective function (such as accuracy, AUC, and log loss).
• Create an initial population of candidate solutions. Each candidate solution signifies a unique set of hyperparameters.
• Train the classification model utilizing each candidate solution. Evaluate the performance on the validation dataset. Document the performance metric.
• Identify the best and worst performing solutions in the current population for each candidate solution.
• Update each candidate solution using the Jaya formula given in Equation 5:
• Develop new models utilizing revised hyperparameters. Assess performance once more. Keep the superior solutions and eliminate the inferior ones.
• Proceed with iterations until either convergence is achieved or a predetermined maximum number of generations is attained. The optimal set of hyperparameters is chosen.
• Construct a final model employing the hyperparameters identified as the best. Assess the final model against the test set.

These steps can be used for feature selection by adding some steps to binarize each solution consisting of feature score values in order to select useful features.

3.4 H2O open source library

H2O is an open source library offering valuable services. Some of these are listed below Cook (2016); Dulhare et al. (2020); LeDell and Poirier (2020); Aiello et al. (2016):

• It offers distributed and in-memory machine learning modeling with different programming languages as Java, R, Python, etc.
• It offers a flexible solution for the generation of greatly scalable Plain old java object (POJO) code. ML models written in R or Python can be experimented. With H2O after conversion to POJO format.
• It reduces the hardware requirement.
• H2O offers an efficient data parser capable to distinguish dataset schema in several different format, imported and accessed from more than one source.

H2O library is exploited for the implementation of DXGB classifiers.

3.5 Distributed XGBoost (DXGB)

DXGB is a distributed version of XGBoost Cook (2016); Dulhare et al. (2020); LeDell and Poirier (2020); Aiello et al. (2016). It is a highly optimized gradient boost algorithm that offers parallel tree boost and hence resolves many classification problems in an accurate and fast manner. This algorithm incorporates enormously useful characteristics to simplify the training and testing process. Some of these are: grid search, early stopping, etc. It can be easily adopted in distributed environments, as it offers support for multi-core, which in turn requires system support.

The next section explicates the application of the dataset, tools, and algorithms mentioned in this section to build the proposed model and analyze the model as well.

4 Experimental setup and result discussion

The workflow of the proposed work is illustrated in figure Figure 2. This section elaborates on each component of the workflow shown in the figure. Additionally, this section reviews the experimental results and compares them with the most recent similar studies.

4.1 Dataset preparation

The CIC-DDoS 2019 Sharafaldin et al. (2018) dataset is preprocessed in this study. Irrelevant 10 features, such as IDs, flow identifiers, and high-cardinality or constant features, namely, FwdAvgBulkRate, FlowID, DestinationIP, FwdAvgBytes/Bulk, FINFlagCount, SourceIP, Simillar-HTTP, PSHFlagCount, Timestamp, and Unnamed:0 are dropped. Target Label is a categorical feature that needs encoding. LabelEncoder from the sklearn python module is used to map unique Label values to encoded labels. Following is the mapping:BENIGN- 0, DNS - 1, LDAP - 2, MSSQL - 3, NTP - 4, NetBIOS - 5, SSDP - 6, UDP - 7, Syn - 8. The StandardScaler from scikit-learn standardizes features by removing the mean and scaling to unit variance. It transforms each feature independently, so that they have:

• Mean = 0
• Standard Deviation = 1

Remaining features are scaled using the StandardScaler Equation 6.

z i = d i − μ σ (6)

where μ is the mean of the feature and σ is the standard deviation of the feature which are represented in Equations 7, 8 respectively.

mean of the feature μ = 1 n ∑ i = 1 n d i (7)

standard deviation of the feature σ = 1 n ∑ i = 1 n d i − μ 2 (8)

d i = value of a feature/dimension in the dataset

n = the number of samples (or data points) used for the feature standardization.

The corr () method of the Pandas DataFrame is utilized to compute the absolute correlation matrix, which facilitates the examination of pairwise correlations among the features within the dataset. A total of 30 features exhibiting cor () values exceeding 0.95 have been identified. These features, which demonstrate high correlation, are subsequently removed. The dataset, now containing 47 features along with one target, is downsampled with the RandomUnderSampler method from the imbalanced-learn python package to retain 28,849 records for each attack flow and one benign flow. Hence, this preprocessed dataset with 47 features contains a total of 259,641 samples, including 8 types of attack records from the second day’s attacks and benign records (refer to table Table 6). The prepared dataset is used to train and evaluate the classifier models with a total of 9 classes of records (8 attacks and 1 benign flow).

TABLE 6. Record types and instances in CIC-DDoS2019 dataset.

4.2 Feature extraction with EGJ algorithm

Following the preparation of data, feature extraction utilizing EGJ is conducted on the processed data. The XGB classifier serves as the foundational classifier within the EGJ fitness function, which is compatible with the distributed classifier models relevant to model development. Figure 3 illustrates the proposed pipeline:

WCE, initializing one Jaya individual with a binarized entropy mask, evolving through Swish-binarized Jaya with adaptive mutation and diversity injections, conducting checkpointing and early stopping, and finally evaluating the resulting subset with H2O XGBoost.

The Algorithm 2 reflects our implementation.

Algorithm 2. Entropy-Guided Jaya (EGJ) with Swish Binarization & Adaptive Mutation.

4.3 EGJ framework description

Figure 3 illustrates the workflow of the proposed Entropy-Guided Jaya (EGJ) feature selection algorithm.

The optimization process begins by generating an initial population of candidate feature subsets. Unlike the conventional Binary Jaya algorithm, which relies entirely on random initialization, EGJ constructs P − 1 solutions randomly and introduces one entropy-guided solution derived from the Weighted Composite Entropy (WCE) scores using equation Equation 4 where: α = 0.3 , β = 0.7. The larger weight assigned to mutual information emphasizes selecting features that are more relevant to the class labels while still accounting for their intrinsic information content. This entropy-seeded solution increases the probability of selecting informative features during the initial search. The continuous population is subsequently normalized and transformed into binary feature masks using the proposed Swish-based transfer function. Swish binarization and stochastic thresholding are applied, In the context of binary feature selection tasks, a binarization phase is crucial for transforming continuous solution vectors into binary format. The proposed feature selection approach capitalizes on the non-monotonic and smooth characteristics of the Swish function for binarization, which converts each dimension d i of the population vector P i into binary by employing a random sampling mechanism on the Swish output. The Swish-based binarization process can be explained in three stages:

• For each candidate solution P i ∈ P, calculate Swish output for each dimension/feature d i ∈ P i using the following Equation 9:

S i = Swish d i = d i ⋅ σ d i = d i ⋅ 1 1 + e − d i (9)

• 2. Normalize the Swish output calculated in step 1 using the following Equation 10:

S i norm = S i − S min S max − S min (10)

• 3. Apply thresholding using Equation 11 on normalized output using random sampling from the uniform distribution within the range (0, 1):

d i binary = 1 , if S i > rand 0,1 0 , otherwise (11)

Each candidate feature subset is evaluated using an XGBoost classifier with three-fold cross-validation, where the macro recall score serves as the fitness function. The use of macro recall ensures balanced optimization across all attack categories, including minority classes that are often underrepresented in multiclass intrusion detection datasets.

After fitness evaluation, the best ( b ) and worst ( w ) solutions in the population are identified. Candidate solutions are then updated according to the standard Jaya search mechanism by moving each solution toward the best solution while simultaneously moving it away from the worst solution. The updated continuous values are clipped to the interval [0, 1] to maintain numerical stability.

To preserve population diversity, the algorithm periodically performs random replacement every three generations. During this process, a fraction ( δ P ) of the candidate solutions is regenerated, introducing new search directions and reducing the likelihood of premature convergence. The updated continuous solutions are then converted into binary feature subsets through the Swish transfer function followed by stochastic thresholding.

An adaptive mutation strategy is subsequently applied to the binary population. The mutation probability is adjusted according to the fitness gap between candidate solutions and the current best solution, allowing poorly performing individuals to explore the search space more aggressively while preserving high-quality solutions. Elite solutions are retained to ensure that the best feature subsets are not lost during successive generations.

At the end of each iteration, the optimization state is checkpointed, enabling recovery and facilitating long-running experiments. The algorithm then evaluates two stopping conditions. If an early stopping criterion is satisfied, or if the maximum number of generations ( G ) has been reached, the optimization terminates and returns the best feature subset S ⋆. Otherwise, the generation counter is incremented and the optimization cycle is repeated until convergence.

Of the 47 features of the CIC-DDoS2019 dataset, 27 are selected, which are listed in the table Table 7.

TABLE 7. Selected features by proposed WCE-Jaya algorithm.

4.4 DDoS attack classification model building

The next step in the experiment is to build a DDoS attack classification model. The parallel computing aspects of H2O can be categorized as follows:

• Single node (local machine) implementation
• Multiple node (in a cluster) implementation

This work implemented the DXGB classifier model on the local machine (implementation on a single node). DXGB model building process is implemented on the H2O platform. Frameworks for multiple nodes (in cluster) classifier implementation are discussed in Patil et al. (2022a); Patil et al. (2022b) that can be applied to implement the proposed implementation in a distributed multiple node manner.

Google Colab notebook is used with Colab pro subscription with runtime configuration of Cloud TPU v6e (Trillium) to build the model. Hyperparameters of the classifier are tuned before training the model. Following setups are used to tune hyperparameters:

• Define hyperparameter space

hyper_params = {

’ntrees’: [100, 200, 300],

’max_depth’: [10, 20, 30],

’min_rows’: [1, 5, 10],

’sample_rate’: [0.7, 0.8, 0.9],

’col_sample_rate_per_tree’: [0.7, 0.8, 0.9]

}

• Define search criteria (for Random Grid Search)

search_criteria = {

’strategy’: “RandomDiscrete”,

’max_models’: 20,

’seed’: 1234

}

Development and evaluation step-by-step process for the DXGB classifier is given in Algorithm 3.

Algorithm 3. DXGB Model development and evaluation step by step process.

4.5 Experimental results analysis

We compute WCE for the Jaya search space and execute the EGJ with early stopping. The final subsets are assessed using the H2O XGBoost algorithm on the H2O platform. The classification ability of the model is examined through various dimensions utilizing different metrics. The definitions of these metrics are provided below in Equations 12–15 Szabó et al. (2024): Here,

• Precision: The emphasis is on minimizing false positives (wrongly classifying negatives as positives).

P r e c i s i o n i = T P i T P i + F P i (12)

• 2. Recall: It tackles the question: “Of all the true positive cases, how many were identified by the model?“.

R e c a l l i = T P i T P i + F N i (13)

• 3. F1-Score: The F1 Score harmonizes precision (the accuracy of positive predictions) and recall (the capacity to recognize all positive instances) into a single metric, computed as their harmonic mean.

F 1 S c o r e i = 2 ⋅ Precision i ⋅ Recall i Precision i + Recall i (14)

• 4. Accuracy: Accuracy pertains to overall correctness and is especially useful for balanced datasets.

A c c u r a c y = ∑ n T P i + T N i T P i + T N i + F P i + F N i (15)

• n- Total records to be considered
• FP_i- Total False positive predictions for class i
• FN_i- Total False negative predictions for class i
• TP_i- Total True positive predictions for class i
• TN_i- Total True negative predictions for class i

Table 8 presents Class-wise precision, recall, and f1 score on the 3 fold cross-validation data, which are calculated using Equation 12, Equation 13, and Equation 14 respectively.

TABLE 8. Precision, recall, and f1-score of WCE-Jaya algorithm.

The same results are depicted in Figure 4 for better understanding. The model demonstrated enhanced performance in detecting both SSDP-based and UDP flood attacks, which are typically challenging to identify in real-world traffic. Among the final 27 selected features, several features are particularly relevant for distinguishing SSDP and UDP attacks (refer to Table 9): EGJ achieved a precision of 76%, a recall of 71%, and an F1 score of 73% for the SSDP attack. For the UDP attack, it attained a precision of 75%, a recall of 77%, and an F1 score of 76%. The overall accuracy reached 93%. The improvement is particularly evident for SSDP and UDP attacks because these classes exhibit high overlap in the original feature space. Entropy-guided initialization accelerates the discovery of informative candidate subsets, while adaptive mutation maintains population diversity throughout optimization, preventing premature convergence toward suboptimal feature subsets. Together, these mechanisms enable EGJ to identify features that better capture packet burstiness, flow asymmetry, and temporal communication behavior, resulting in improved precision and recall for SSDP and UDP attacks.

TABLE 9. Most discriminative EGJ-selected features for SSDP and UDP attack detection.

✓, ✓ ✓, and ✓ ✓ ✓ denote low, moderate, and high relative importance, respectively, based on the discriminative capability of the selected features for distinguishing SSDP and UDP attacks.

4.6 Comparative analysis

Tables 10–13 represent the statistical comparison of the proposed work with recent similar works KS-DDoS Patil et al. (2022a) and SSK-DDoS Patil et al. (2022b). Where:

• MIJ–Memory-Efficient Scalable Multi-Island Jaya based model Singh and Khare (2026).
• KS-I–Assessment of KS-DDoS for Case-I, during the design phase Patil et al. (2022a).
• KS-II–Assessment of KS-DDoS for Case-II (Post-deployment) Patil et al. (2022a).
• SSK-I–Assessment of SSK-DDoS for Case-I, during the design phase Patil et al. (2022b).
• SSK-II–Assessment of SSK-DDoS for Case-II (Post-deployment) Patil et al. (2022b).

TABLE 10. WCE-Jaya precision comparison.

BENIGN- 0, DNS, 1; LDAP, 2; MSSQL, 3; NTP, 4, NetBIOS, 5; SSDP, 6; UDP, 7, Syn - 8. The symbol “–” signifies that the related network traffic was not monitored.

TABLE 11. WCE-Jaya recall comparison.

BENIGN- 0, DNS, 1; LDAP, 2; MSSQL, 3; NTP, 4, NetBIOS, 5; SSDP, 6; UDP, 7, Syn - 8. The symbol “–” signifies that the related network traffic was not monitored.

TABLE 12. WCE-Jaya f1 score comparison.

BENIGN- 0, DNS, 1; LDAP, 2; MSSQL, 3; NTP, 4, NetBIOS, 5; SSDP, 6; UDP, 7, Syn - 8. The symbol “–” signifies that the related network traffic was not monitored.

TABLE 13. WCE-Jaya Accuracy comparison.

Two scenarios are analyzed for assessing the performance of the KS-DDoS and SSK-DDoS classification systems: Case I (referred to in our study as KS-I) focuses on the design of the classification model for DDoS attacks, while Case II (referred to in our study as KS-II) evaluates the model post-deployment. For Case II evaluation, various scenarios are explored using different combinations of classes from the CICDDoS2019 dataset. The KS-DDoS classification method is implemented across ‘KSC-1’, ‘KSC-2’, and ‘HC-1’ in a distributed fashion. The roles of ‘KSC-1’, ‘KSC-2’, and ‘HC-1’ include preprocessing incoming network traces, real-time classification of these traces, and storing features along with predicted classes in HDFS, respectively. In Case I, three highly scalable machine learning algorithms—GBM, DRF, and NB—are employed. Among these, DRF has shown superior accuracy compared to both GBM and NB. As a result, the outcomes generated by DRF are selected for comparison with the proposed work. In Case II, following the deployment of the efficient distributed classification model, the performance of four scenarios is evaluated. Scenario II has exhibited superior accuracy relative to the other three scenarios, leading to the selection of its outcomes for comparison with the proposed work. Notably, DNS, NTP, and SSDP are not traced in this scenario. The SSK-DDoS classification system categorizes network flows into seven classes: UDP, LDAP, DNS, SYN, MSSQL, NetBIOS, and Benign. In Case I, this model is constructed using four Spark MLlib machine learning algorithms: DTC, MLR, NB, and RF. RF has achieved the highest accuracy, prompting its deployment in the production environment in Case II. Scenario I has shown superior accuracy compared to the other six Scenarios, resulting in its outcomes being chosen for comparison with the proposed work. In Tables 10–12, the entries for attacks not traced in the comparative work are represented with a dash (−). The proposed method outperforms these DDoS detection methods.

4.7 Statistical significance analysis

Although the proposed EGJ method improves the overall detection performance by approximately 3% compared with the baseline Multi-Island Jaya (MIJ) algorithm, this improvement is meaningful in the context of high-dimensional DDoS detection. Both methods employ the same optimization framework, and therefore large performance differences are not expected. The observed improvement arises from the entropy-guided initialization strategy, which prioritizes informative features at the beginning of the search, enabling the optimization process to converge toward higher-quality feature subsets. In addition, the adaptive mutation and diversity-preserving mechanisms improve the balance between exploration and exploitation, reducing the likelihood of premature convergence to local optima. Consequently, EGJ identifies feature subsets that provide better class discrimination while avoiding redundant and irrelevant features.

From a practical perspective, a 3% improvement in detection performance can have a substantial operational impact in real-world network environments. When monitoring millions of network flows, even a small increase in detection accuracy or recall can correspond to thousands of additional malicious flows being correctly identified, thereby reducing the number of undetected DDoS attacks and improving the overall reliability of intrusion detection systems. Furthermore, the improvement is achieved without increasing model complexity or substantially increasing computational cost, making the proposed approach suitable for deployment in resource-constrained environments.

To determine whether the performance improvements achieved by the proposed Entropy-Guided Jaya (EGJ) framework over the baseline Multi-Island Jaya (MIJ) algorithm are statistically significant, the non-parametric Wilcoxon signed-rank test was performed. The Wilcoxon test was selected because it does not assume normality of the paired observations and is well suited for comparing machine learning algorithms using paired performance measures?

The test was conducted using the per-class precision, recall, and F1-score values of the nine traffic classes (BENIGN, DNS, LDAP, MSSQL, NTP, NetBIOS, SSDP, UDP, and SYN) as paired observations. Since the objective was to verify whether EGJ consistently outperformed MIJ, a one-sided exact Wilcoxon signed-rank test was employed with the alternative hypothesis that the performance of EGJ is greater than that of MIJ.

Table 14 summarizes the obtained test statistics. The proposed EGJ framework achieved statistically significant improvements over MIJ for all three evaluation metrics. In particular, the precision comparison yielded a Wilcoxon statistic of W = 15.0 with an exact p-value of 0.03125. Similarly, both recall and F1-score produced a Wilcoxon statistic of W = 21.0 with exact p-values of 0.015625. Since all obtained p-values are below the significance level of α = 0.05, the null hypothesis is rejected in each case.

TABLE 14. Exact Wilcoxon signed-rank test comparing EGJ and MIJ using per-class performance metrics.

The Wilcoxon signed-rank test was performed using the paired per-class performance values of the nine traffic classes. The null hypothesis ( H 0 ) states that there is no significant difference between EGJ and MIJ, while the alternative hypothesis ( H 1 ) states that EGJ achieves superior performance. Statistical significance was determined at α = 0.05.

These results demonstrate that the performance improvements obtained by the proposed EGJ framework are statistically significant rather than being attributable to random variation. The consistent gains across precision, recall, and F1-score further confirm that integrating Weighted Composite Entropy (WCE)-guided initialization, Swish-based binary transformation, and adaptive mutation enables EGJ to produce more discriminative feature subsets than the conventional MIJ algorithm, particularly for challenging attack classes such as SSDP and UDP.

4.8 Evolution of jaya-based feature selection and positioning of the proposed EGJ

The development of Jaya-based feature selection algorithms has progressively enhanced exploration capability, convergence behavior, and computational efficiency for high-dimensional optimization problems. Although several variants have been proposed for general feature selection, only a limited number have been evaluated for cybersecurity applications, particularly on the CIC-DDoS2019 benchmark dataset. The major developments leading to the proposed Entropy-Guided Jaya (EGJ) framework are summarized below.

4.8.1 Evolution of jaya-based feature selection

• Binary Jaya introduced binary search using similarity measures to improve feature subset optimization and demonstrated competitive performance on benchmark feature selection problems Chaudhuri and Sahu (2022).
• Improved Binary Jaya Algorithm (IBJA) enhanced Binary Jaya by incorporating Dynamic Opposition-Based Learning and Harris Hawks Optimization, resulting in improved convergence and smaller feature subsets on UCI benchmark datasets Abed-alguni and Al-Jarah (2024).
• Memory-Efficient Multi-Island Jaya (MIJ) was the first Jaya-based feature selection framework evaluated on the CIC-DDoS2019 dataset. It addressed scalability and memory limitations through D-optimal initialization and parallel island-based optimization, achieving 89.9% accuracy, 89.9% precision, 90.0% recall, and 89.9% F1-score using H2O AutoML Singh and Khare (2026).

A comprehensive review of the literature indicates that, apart from the Memory-Efficient Multi-Island Jaya framework and the proposed EGJ algorithm, no other published study has specifically employed a Jaya-based wrapper feature selection framework for multiclass DDoS detection using the CIC-DDoS2019 dataset.

4.8.2 Comparative analysis of jaya-based feature selection algorithms

Table 15 compares the proposed EGJ framework with representative Jaya-based feature selection algorithms. Unlike existing approaches, EGJ integrates Weighted Composite Entropy (WCE)-guided population initialization with adaptive mutation and Swish-based binary transformation to improve population diversity and convergence. Furthermore, EGJ employs an XGBoost-based wrapper and is specifically designed for scalable feature selection on the imbalanced CIC-DDoS2019 dataset.

TABLE 15. Comparison of the proposed EGJ with representative Jaya-based feature selection algorithms.

4.8.3 Comparison with existing ML-Based DDoS detection frameworks

Beyond feature selection, numerous machine learning frameworks have been proposed for DDoS detection. Table 16 compares representative ML-based DDoS detection systems with the proposed EGJ-DXGB framework in terms of deployment architecture, learning algorithms, benchmark datasets, and supported attack categories. Existing studies primarily employ conventional or distributed machine learning techniques for detecting selected attack types. In contrast, the proposed framework combines EGJ-based wrapper feature selection with Distributed XGBoost (DXGB) to construct a lightweight multiclass detection model capable of identifying diverse reflection, amplification, and flooding attacks while simultaneously reducing feature dimensionality.

TABLE 16. Comparison of representative ML-based DDoS detection systems and the proposed EGJ-DXGB framework.

Overall, the proposed EGJ framework extends existing Jaya-based feature selection methods by incorporating entropy-guided initialization, adaptive diversity preservation, and an XGBoost-based wrapper evaluation strategy. Compared with representative distributed DDoS detection frameworks, EGJ-DXGB provides a lightweight and scalable solution for multiclass DDoS detection while maintaining high classification performance using a compact subset of informative features.

4.9 Cross-dataset evaluation

To further assess the robustness of the proposed framework, EGJ-XGB was additionally evaluated on the UNSW-NB15 dataset, which was previously used in our previous work Singh and Khare (2021), thereby providing a familiar and well-established benchmark for assessing the generalization capability of the proposed feature selection framework. To ensure a fair evaluation, the same EGJ-XGB based feature selection methodology and XGBoost classifier configuration were applied without modifying the core optimization strategy.

The class-wise analysis indicates excellent detection performance for several attack categories, including Generic (F1-score: 99.07%), Normal (93.05%), Reconnaissance (88.11%), Shellcode (98.42%), and Worms (99.72%). Comparatively lower performance was observed for Analysis, Backdoor, and Exploits, which are known to exhibit greater overlap with other attack categories and pose a more challenging multi-class classification problem.

Despite being optimized for DDoS detection on CIC-DDoS2019, EGJ-XGB achieved an overall accuracy of 83.38%, precision of 85.00%, recall of 83.38%, and F1-score of 83.47% on the UNSW-NB15 validation dataset for the more diverse multi-class intrusion detection task, indicating that the entropy-guided feature selection strategy generalizes well across different network traffic datasets while highlighting opportunities for further optimization on heterogeneous attack distributions. Table 17 presents the cross-dataset performance of the proposed EGJ-XGB framework.

TABLE 17. Cross-dataset validation of the proposed EGJ-XGB framework on the CIC-DDoS2019 and UNSW-NB15 benchmark datasets.

The results indicate that the entropy-guided feature selection strategy generalizes effectively beyond the CIC-DDoS2019 dataset while achieving robust performance on the UNSW-NB15 benchmark.

Performance difference is expected because:

• CIC-DDoS2019 focuses on DDoS attack categories, whereas UNSW-NB15 contains a broader range of attack types with more diverse and overlapping traffic patterns.
• The EGJ framework was tuned for DDoS detection, yet it maintains competitive performance on a substantially different benchmark without changing the optimization strategy.
• This additional evaluation demonstrates the framework’s adaptability while highlighting opportunities for future work to further optimize it for general intrusion detection tasks.

4.10 Complexity analysis

The computational efficiency of the proposed Entropy-Guided Jaya (EGJ) algorithm is analyzed in terms of its time and space complexity and compared with the conventional Binary Jaya and Multi-Island Jaya (MIJ) algorithms.

Let N denote the population size, D the number of candidate features, G the maximum number of generations, K the number of islands in MIJ, M the number of migrated individuals, n the number of training instances, and T f the computational cost of evaluating a candidate feature subset using the XGBoost wrapper with 3-fold cross-validation.

4.10.1 Time complexity

For Binary Jaya, each generation updates all candidate solutions and performs binary transformation followed by wrapper-based fitness evaluation. The position update and binary conversion require O ( N D ) operations, whereas the wrapper evaluation dominates the computational cost. Consequently, the overall time complexity is

O G N D + N T f .

Since the wrapper evaluation is considerably more expensive than the position update ( T f ≫ D ), the practical complexity reduces to

O G N T f .

The MIJ algorithm partitions the population into K independent islands that evolve simultaneously. Assuming an even population distribution, each island contains approximately N / K individuals. The computational complexity per generation remains identical to Binary Jaya, while periodic migration introduces an additional overhead of O ( K M ). Therefore, the overall complexity is

O G N D + N T f + G K M ,

which is asymptotically equivalent to

O G N T f

because the migration overhead is negligible compared with wrapper evaluation.

The proposed EGJ introduces three additional operations: (i) Weighted Composite Entropy (WCE) computation, (ii) Swish-based binary transformation, and (iii) adaptive mutation with periodic random replacement. The WCE scores are computed only once before optimization and require

O D n

operations. During optimization, Swish activation and adaptive mutation each require linear time with respect to the population size and feature dimension, i.e.,

O N D .

Therefore, the total computational complexity of EGJ is

O D n + G 2 N D + N T f .

Since the entropy computation is performed only once and the wrapper-based fitness evaluation dominates the runtime, the asymptotic complexity becomes

O G N T f ,

which is identical to Binary Jaya and MIJ while providing improved convergence through entropy-guided initialization and adaptive search mechanisms.

4.10.2 Space complexity

The memory requirement of Binary Jaya is primarily determined by storing the population, binary feature masks, and fitness values. Therefore, its overall space complexity is

O N D .

In MIJ, the population is distributed across K islands while maintaining the same total number of individuals. Additional memory is required for migration buffers and elite solutions, resulting in

O N D + K M ,

which simplifies to

O N D

because K M ≪ N D.

The proposed EGJ maintains the same population representation as Binary Jaya and additionally stores a feature-level entropy score vector together with temporary Swish activation values and mutation probabilities. Consequently, its memory requirement is

O N D + D ,

which simplifies to

O N D

since the population storage dominates the additional feature-level vectors.

Overall, EGJ introduces only linear computational and memory overhead while preserving the asymptotic complexity of conventional Jaya algorithms. The additional entropy computation and adaptive search operators improve initialization quality and population diversity without increasing the dominant computational cost of wrapper-based feature evaluation. Table 18 shows that the proposed EGJ algorithm introduces only linear additional computations associated with Weighted Composite Entropy (WCE), Swish-based binarization, and adaptive mutation. These operations either execute once prior to optimization or require O ( N D ) operations per generation. Consequently, the wrapper-based XGBoost evaluation remains the dominant computational cost, preserving the same asymptotic time and space complexity as Binary Jaya and Multi-Island Jaya. The proposed enhancements therefore improve convergence behaviour and feature subset quality without compromising computational scalability, making EGJ suitable for high-dimensional network intrusion detection problems such as CIC-DDoS2019.

TABLE 18. Comparison of computational characteristics of Binary Jaya, Multi-Island Jaya (MIJ), and the proposed Entropy-Guided Jaya (EGJ).

5 Conclusions and future work

This paper presented an Entropy-Guided Jaya (EGJ) wrapper-based feature selection framework for multiclass DDoS detection using the CIC-DDoS2019 dataset. The proposed EGJ integrates Weighted Composite Entropy (WCE)-guided population initialization, Swish-based binary transformation, adaptive mutation, and XGBoost-based wrapper evaluation to improve feature subset quality and optimization performance. Experimental results demonstrated that EGJ effectively selected a compact subset of 27 informative features while achieving high detection performance with reduced feature dimensionality, computational cost, and memory requirements. Furthermore, the proposed framework improved the detection of challenging attack categories, particularly SSDP and UDP, demonstrating its robustness for high-dimensional and imbalanced network traffic data.

Although the proposed EGJ framework demonstrates improved performance for DDoS detection, consistent improvements over existing Jaya-based feature selection methods, several limitations should be acknowledged. First, the experimental evaluation is primarily conducted on the CIC-DDoS2019 dataset, with additional validation on the UNSW-NB15 dataset. Although these datasets are widely used benchmarks, further validation on other publicly available and real-world network traffic datasets is necessary to establish the broader generalizability of the proposed approach. Furthermore, this study does not include a comprehensive ablation analysis to quantify the individual contribution of each algorithmic component. Specifically, the effects of Swish-based binarization, adaptive mutation, entropy-guided initialization, the weighted composite entropy formulation, and the H2O Distributed XGBoost (DXGB) classifier were evaluated as part of the complete framework rather than in isolation. Consequently, the relative impact of each component on the overall performance has not been independently quantified. Future work will conduct a systematic ablation study by selectively enabling and disabling these components while maintaining identical experimental settings. Such an analysis will provide deeper insights into the contribution of each design choice and further validate the effectiveness of the proposed EGJ framework.

Future work will also focus on extending EGJ to real-time distributed intrusion detection environments, investigating alternative binary transfer functions and adaptive search strategies, and evaluating the proposed framework on additional cybersecurity datasets, including CICIoT2023 and other large-scale network intrusion benchmarks. The integration of EGJ with online and streaming learning frameworks also represents a promising direction for adaptive DDoS detection in dynamic network environments.

Generative AI statement

The author(s) declared that generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Antonino Galletta, University of Messina, Italy

Reviewed by: M. Prasad, Shri Vishnu Engineering College for Women, India

Mauparna Nandan, Techno Main Salt Lake, India