Representation-Dependent Learning Behaviour in Machine Learning-Based DDoS Intrusion Detection: Experimental Evidence and the Representation-Dependent Discriminative Structure Principle

This study investigates whether learning behaviour in DDoS intrusion detection is determined solely by learning architecture or is also influenced by how the investigated network traffic is represented. A representation-aware experimental methodology is developed in which traffic representation is treated as the primary manipulated factor within each benchmark dataset, while benchmark harmonization, preprocessing, learning architectures, and evaluation protocols are controlled. Three complementary representations—Flow, Header, and Hybrid—are constructed from the same selected traffic instances within each benchmark dataset and evaluated using five representative machine learning and deep learning architectures. Predictive performance, experimental reproducibility, cross-representation stability, confidence calibration, and representation sensitivity are assessed using repeated experiments and statistical validation. The results show systematic differences across representations in predictive performance, cross-representation stability, calibration, and representation sensitivity under the controlled experimental conditions. These findings indicate that traffic representation is associated with differences in the discriminative structures made computationally available to learning algorithms rather than serving solely as a preprocessing mechanism. Based on these observations, the Representation-Dependent Discriminative Structure Principle (RDDSP) is proposed as a context-specific conceptual hypothesis describing how representation-exposed discriminative structures may interact with the inductive characteristics of learning architectures to shape learning behaviour in the investigated DDoS intrusion-detection setting. The empirical evaluation is restricted to a common attack space comprising SYN Flood and UDP Flood, together with Benign traffic, and uses a controlled, class-balanced evaluation distribution. Broader applicability of the findings and RDDSP remains subject to validation across additional attack categories, independently collected datasets, and operationally representative class-prevalence distributions.