RF-OCSA: A Hybrid Metaheuristic Feature Selection Framework for DDoS Attack Detection in Cloud Environments

Distributed Denial of Service (DDoS) attacks have emerged as one of the most critical cybersecurity threats to cloud computing environments, significantly affecting service availability, resource utilization, and operational reliability. The dynamic nature of cloud traffic and the increasing sophistication of attack patterns make accurate and efficient DDoS detection a challenging task. To address this issue, this paper proposes a hybrid feature-selection and classification framework, namely Random Forest-based Oppositional Crow Search Algorithm (RF-OCSA), for intelligent DDoS attack detection in cloud environments. The proposed framework consists of data preprocessing, optimal feature selection using the Oppositional Crow Search Algorithm (OCSA), and attack classification using the Random Forest (RF) classifier. OCSA employs oppositional learning to enhance search diversity and identify the most discriminative features while reducing feature redundancy and computational overhead. The effectiveness of the proposed RF-OCSA model is evaluated using four benchmark datasets, namely CIC-DDoS2019, AISED, TestCloudIDS, and UNSW-NB15. Experimental analysis is conducted using Accuracy, Sensitivity, Specificity, Precision, and F-measure as evaluation metrics, while NS-3 is utilized to emulate representative cloud-network traffic scenarios. The results demonstrate that RF-OCSA consistently outperforms GHLBO, CNN-LSTM, and DeepDefend by achieving superior detection performance across all datasets, with classification metrics exceeding 98% in most cases. The integration of oppositional feature optimization and ensemble learning significantly improves attack detection capability, reduces false alarms, and enhances model robustness. These findings indicate that RF-OCSA is an effective and scalable framework for securing cloud infrastructures against evolving DDoS attacks.