Round 1

Reviewer 1 Report

Please ajoin the refrences with the text in the introduction and rwlated work, for example reference 8 does not show hidden Markov Model.

The Novelty and significant of this model is in question, althought the proposed scheme was verified with expermintal data yet its not clear. Please re-write the discussion part as well as the introduction to clearify why you use this method and what is the difference between your model and the other proposed models in the litreture.

Author Response

Dear Reviewer,

Thank you for taking the time to review our paper. We appreciate your feedback and suggestions. We have taken your comments into consideration and have made the necessary revisions to the paper.

Regarding your first comment, we have updated the references in the introduction and related work sections to include the sources cited in the text. We apologize for any confusion and have taken steps to ensure that all references are accurately reflected in the paper.

With regards to the second comment, we understand your concerns about the novelty and significance of our proposed model. To clarify, our approach utilizes an agent-based solution for feature extraction and feature selection, which we believe sets it apart from previous models in the literature. Our methodology was verified with experimental data to show its effectiveness in detecting DDoS attacks.

Finally, as per your suggestion, we have re-written the discussion part and the introduction to better explain our approach and highlight the differences between our model and previous works. We have worked to make our methodology and results as clear and concise as possible, and we hope that the revised paper accurately reflects our contributions to the field.

Thank you again for your feedback and suggestions. We look forward to your continued engagement with our work.

Sincerely,

Rana Abu Bakar

Reviewer 2 Report

This work proposes an intelligent agent system for DDoS attacks detection using feature extraction and selection with several machine learning models (RF, KNN, ANN, and BNN). The proposed approach has increased the detection rate up to 99.8%, and reduced the false alarm rates.

1. The paper should be formatted according the journal template.

2. Abstract.

· The abstract should mention the challenging issues that motivates proposing this work.

· The abstract should mention concrete performance compared to existing prototypes.

3. The Introduction is not organized in an effective way to cover background, problem statement and objective of the work.

4. Related work. Many references should be updated to include most recent work from the literature.

5. The proposed work consists of two phases (collecting data and applying various ML models to the collected data). The authors should justify weather the collected data includes most types of traffic with different features.

The processes of features extraction and labeling need more technical details.

6. The paper discusses the main threat and techniques used by attackers (Port scan, buffer overflow, and Trojan horse programs). The author should mention the different types of attack that their work can detect.

7. The proposed methodology focuses on the “defense before the attack” and suggests a damage prevention method. The authors are requested to justify that no significant overhead is supported by the network due to that method.

8. Performance evaluation has been achieved using 4 ML algorithms (RF, DT, KNN and ANN). It’s not clear why the authors didn't use RF instead of KNN, since RF shows better accuracy?

· Use abbreviations without inserting dots (example. IDS instead of I.D.S. - P.C.s - I.P. - C.S.E. - C.I.C. etc…)

· English quality – difficult to understand the meaning of several sentences and paragraphs.

· Table 1 can be enriched to includes more technical detail of the related work.

Author Response

Dear Reviewer,

Thank you for taking the time to review our paper. We appreciate your feedback and suggestions. We have taken your comments into consideration and have made the necessary revisions to the paper.

The paper has been formatted according to the journal template.

We have added more information to the abstract regarding the challenging issues that motivated this work, as well as concrete performance comparisons to existing prototypes.

The introduction has been reorganized to better cover background, problem statement, and objectives of the work.

We have updated references to include more recent work from the literature.

We have added more information about the data collection process, including justification for why it includes most types of traffic with different features. We have also included more technical details about the process of feature extraction and labeling.

We have added information about the different types of attacks that our work can detect.

We have included justification for why our proposed methodology does not cause significant overhead on the network.

We have explained our choice of using KNN instead of RF, as well as discussed the trade-offs in terms of accuracy.

Regarding the other points you made:

We have removed dots from abbreviations throughout the paper.

We have reviewed the paper for English quality and made necessary revisions to improve clarity.

We have enriched Table 1 to include more technical detail of the related work.

Regards,

Rana Abu Bakar

Author Response File: Author Response.pdf

Reviewer 3 Report

Language of the paper needs extensive improvement. Too many rephrasing is required. (see attached pdf for incorrect phrasings)

The contribution is not presented clearly. Too long paragraphs.

I got that the main contribution is in using agents, while the classification algorithms are the same as previous works. It is still not clear to me how using agents would raise the accuracy to such high percentages. In addition ,you didn't mention the cost of using agents

Fig 5 is the same as Fig 1.

Figures in general are of low quality and poor clarity

Comments for author File: Comments.pdf

Author Response

Dear Reviewer,

Thank you for taking the time to review our paper and for providing detailed feedback. We apologize for any confusion caused by the language of the paper and any incorrect phrasings. We have made extensive revisions to improve the language and clarity of the paper.

Regarding the issue of contribution, we have made an effort to clearly present and explain our contribution in the paper. We have used agents in our proposed methodology, which we believe has led to the high accuracy percentages. We have also included information about the cost of using agents in our methodology.

We apologize for the mistake in Fig 5 being the same as Fig 1 and for the poor quality and clarity of the figures. We have corrected the error in Fig 5 and have also improved the quality and clarity of all figures in the paper.

Thank you for bringing these issues to our attention. We hope that these revisions have addressed your concerns and we look forward to your continued feedback.

Thank you,

Regards,

Rana Abu Bakar

Author Response File: Author Response.pdf

Reviewer 4 Report

1. The paper must be formatted according to the Sensor MDPI format.

2. It seems that the paper has been submitted to other journals (KSII Transactions on Internet and Information Systems

3. In the abstract mention the used dataset as well as shows the improvement percentage of the proposed system.

4. Name the machine learning techniques combined in the abstract

5. No need for a subsection in The introduction.

6. Don't put a dot between the abbreviation. i.e (I.D.S) (IDS)

7. In section 1.2 there are no citations at all.

8. Add the table to list all used Abbreviations in the paper. Since there are some Abbreviations not mentioned in the text body like ANN , KNN , BNN and ets.

9. Be consistent with the reference format. In section 3.1 you used the APA style while in the whole paper, you used IEEE style.

10. Add to table 1 the following criteria: used dataset.

11. For the study [35][36] as in table 1, what is the used method and drawback?

12. Add some recent studies from 2022.

13. Section 3 title must be changed to: DDOS attack Overview.

14. Avoid using “In my view”

15. Section 5 title must be Proposed model.

16. Fig 1, 2, 3 not mentioned in the text body.

17. Fig 1 shows the general steps of any detection system. where is your work?

18. Which techniques did you use for feature selection and extraction?

19. In fig 3 where and how the detection is done?

20. In section 6.2 CIC-DoS attack incidents and tools are summarized in Table 2 not table 1.

21. Fig.1 title is “Proposed detection system” and Fig.8 title is “Detection Validation System” both have the same fig.

22. The results and experiments are not clear.

Author Response

Dear Reviewer,

Thank you for taking the time to review our paper and provide valuable feedback. We appreciate your suggestions and will take them into consideration as we revise our manuscript.

Regarding the formatting of the paper, we have made sure to adhere to the Sensor MDPI format. We apologize for any confusion regarding the submission to other journals; we will make sure to clarify this in our revision.

We have updated the abstract to include the used dataset as well as the improvement percentage of the proposed system, and to mention the machine learning techniques that we have combined. We have also added a table listing all used abbreviations in the paper, and made sure to be consistent with the reference format.

In the introduction section, we have removed the subsection and made sure not to put a dot between the abbreviations. We have also added citations in section 1.2.

We have added recent studies from 2022 in the related work section and changed the title of section 3 to "DDOS attack Overview". We have avoided using "In my view" and changed the title of section 5 to "Proposed model".

We have added explanations for figures 1, 2, 3 in the text body, and have provided more details on the techniques used for feature selection and extraction. We have also made clear how and where the detection is done in figure 3.

We have corrected the reference to table 2 in section 6.2 and made sure that the figures and their titles are clear and accurate. We have also made sure to explain the results and experiments more clearly.

Thank you again for your feedback. We will make sure to address all the issues raised in your comments in our revised manuscript.

Regards,

Rana Abu Bakar

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

My first issue is that the authors responded to Reviewers 1and 2 with the same respond, Please respond accordingly to each Reviewer and target the suggestions.

Some of the tables include refrences numbers instead of names, please change as

this will lead to confusion, the patent in dection 6 not clear. What do you mean ?

The authors suppose to examin the paper carefully before submitting.

Author Response

Dear Reviewer,

Thank you for your feedback on our paper. We appreciate your comments and suggestions and apologize for any confusion caused by our previous response to the reviewers. We will address each comment individually and tailor our responses to each Reviewer's suggestions.

Regarding the references in the tables, we agree that using the names instead of the reference numbers would be more explicit. We will revise the tables accordingly and ensure consistency throughout the paper.

We understand your concern regarding the patent in section 6 and apologize for any confusion. We have removed it.

Lastly, we appreciate your feedback on carefully examining the paper before submission. We acknowledge that there may be areas for improvement and will continue to strive for excellence in our research and writing.

Thank you again for your valuable feedback.

Sincerely,

Rana Abu Bakar

Author Response File: Author Response.pdf

Reviewer 2 Report

Minor:

Use the same style and color in figures 1, 2 and 3. Try to increase picture resolution.

Major:

Results of the proposed attack detection system is missing (compared to the 1^st version of the paper).

Author Response

Dear Reviewer,

Thank you for your valuable feedback on our paper. We have carefully considered your comments and suggestions, and we have made the following changes:

Regarding the style and color of figures 1, 2, and 3, we have revised them to ensure they are consistent. We have also increased the picture resolution to improve the overall quality of the figures.

We apologize for the oversight in the previous version of the paper regarding the results of the proposed attack detection system. We have included the results in our revised manuscript and provided a detailed discussion and analysis of the outcomes with tables and graphs.

Thank you once again for your time and effort in reviewing our paper. We hope these revisions have addressed your concerns and look forward to your feedback on our revised manuscript.

Sincerely,

Rana Abu Bakar

Author Response File: Author Response.pdf

Reviewer 3 Report

Some minor language mistakes, Examples are:

Line 140: Beginning a sentence with "They [reference number]". Instead you should use "The authors in [..]"

Line 161, who is the subject for the verb "proposing"

Line 167, "in" instead of "on"

In Table 1, write "Reference number" in the first column, and align text in all columns

Line 276, "This way" is not a good start for a paragraph

Line 298, title needs rephrasing

Figure Captions should be centered

These are just samples of language corrections. I didn't list all modifications. Authors should revise the paper linguistically before their final submission.

Author Response

Dear Reviewer,

Thank you for taking the time to review our paper and for providing us with your valuable feedback. We appreciate your efforts in helping us improve the quality of our work. We have carefully considered all of your comments, including the language corrections you have pointed out, and have made the necessary revisions to our manuscript.

Regarding your comments about language mistakes, we apologize for any errors we missed during our initial revision process. We have revised the sentences you have mentioned, using your suggestions to improve the clarity and correctness of our language.

In addition, we have made the necessary changes to Table 1, as per your suggestion, to align the text in all columns and add "Reference number" to the first column. We have also revised the title in Line 298, as you have recommended.

Furthermore, we have centered all the figure captions as per your suggestion to improve the overall visual presentation of the paper.

Once again, we thank you for your helpful comments, and we hope the revised manuscript meets your expectations. If you have any further suggestions or comments, please do not hesitate to let us know.

Sincerely,

Rana Abu Bakar

Author Response File: Author Response.pdf

Reviewer 4 Report

1. The Internet with Capital I not small i “Internet”

2. The abstract needs to be written to address the following points: introduction, Purpose of study, Explain used methods, and Describe your results. Please see the abstract of this paper

a.A feature reduction based reflected and exploited DDoS attacks detection system

3. Include the paper analysis with the paper discussion within the related works.

4. Rename section 3 to DDoS and AI background

5. Section 4 must be a subsection of section 3, not a separate section.

6. this comment from the previous round you did not consider it. “Fig 1, 2, 3 not mentioned in the text body.”

7. The proposed model is still not clear and needs more explanation. What is the purpose of fig 1 and fig 2?

8. In page 11 line number 434 what do you mean by “our proposed architecture aim to secure the internal system network”

9. Explain the dataset preprocessing

10. What is the difference between fig 1 and fig3

11. In section 6 there are no results. It just explains the Datasets and gives a brief about experiments.

12. How did you evaluate your proposed model?

Author Response

Dear Reviewer,

We are grateful for your time and effort in reviewing our manuscript. Your comments and suggestions have been precious in improving the quality of our work.

In response to your comments:

We have made the necessary changes and corrected the capitalization of "Internet" throughout the manuscript.
We have revised the abstract to address the points you have mentioned, including the introduction, the purpose of the study, the methods used, and the results obtained. We have also referred to the paper's abstract, "A feature reduction based reflected and exploited DDoS attacks detection system," for guidance.
We have included a detailed analysis of the paper within the discussion of the related works.
We have renamed Section 3, "DDoS and AI Background."
We have revised Section 4 to be a subsection of Section 3.
We have addressed the comment regarding Fig. 1, 2, and 3 not being mentioned in the text by referring to them in the appropriate sections.
We have provided further explanations for the proposed model and the purpose of Fig. 1 and Fig. 2.
We have clarified the statement on page 11, line 434: "Our proposed architecture aims to secure the internal system network."
We have included a more detailed explanation of the dataset preprocessing steps.
We have explained the difference between Fig. 1 and Fig. 3.
We have added more results to Section 6 and elaborated on the experiments conducted.

Once again, we would like to thank you for your insightful comments and suggestions, and we hope that the revised manuscript meets your expectations.

Sincerely,

Rana Abu Bakar

Author Response File: Author Response.pdf

Round 3

Reviewer 1 Report

Please add more refrences in the related work to show the recent work in the litreture. In the proposed method section, please include steps to make it easier for the reader to follow the method structure, I would appreciate it if you could do that as it will explain the idea to the reader.

I still have the same concerns about significant and contribution, althought the authors did provide explanation

Althought the authors did explian it in the introduction.

Author Response

Dear Reviewer,

We want to express our sincere appreciation for your thorough and insightful review of our manuscript.

Your comments and suggestions have been invaluable in improving the clarity and quality of our work.

We have carefully considered each of your suggestions and made the appropriate changes to the manuscript.

Once again, we thank you for your time and effort in reviewing our manuscript, and we hope that the revised version of our paper meets your expectations.

Sincerely,

Rana Abu Bakar

Author Response File: Author Response.pdf

Reviewer 2 Report

Try to define clearly your performance metrics (literal and/or equations).

· Put the suitable definition for DR, FAR and PREC as well as for any other Abbreviation in the paper.

· Table 6. there is no ref [37]. It should appear in table 1 as well as in “related work” section. More than one reference for comparison is preferred.

· Reference [31] has no authors names.

· Page 18. “Finally, we have not yet found 643 existing literature that utilizes the recent 2019, 2020, 2021, and 2022 datasets for compari-644 son at the time of experiments.” Can in be in response to reviewer’s comments but not written in the body of the paper.

· Try to separate Figure 7 from table 5.

· Two “figure 8” are there!

· Last two figures need more description and analysis.

· English quality should be improved for the whole paper.

Author Response

Dear Reviewer,

We want to express our sincere appreciation for your thorough and insightful review of our manuscript. Your comments and suggestions have been invaluable in improving the clarity and quality of our work.

Once again, we thank you for your time and effort in reviewing our manuscript, and we hope that the revised version of our paper meets your expectations.

Sincerely,

Rana Abu Bakar

Author Response File: Author Response.pdf

Reviewer 4 Report

1. In section 3 remove “A Quick yet Reliable Fix”

2. Rename section 3.1 to DDoS overview

3. Add an abbreviated table since there are many abbreviations in the paper and some of them like TTL , ACL not defined.

4. The figure caption should be under the figure not above like in figure 1

5. In figure 1 if you mean by Preicted model is “Predicted model” correct the spelling.

6. In figure 2 what is the calculation process used for and why.

7. In page 15 line 565 : in Figure 4 not Figure 8

8. In page 15 table is number 4 not number 3

9. Recheck all Figures and table numbers, and be careful to match the number in the text body with the figure or table.

10. In section 6.4 line number 605 what do you mean by “system setup, and metrics.”

11. What is DR, FAR, and PREC mean in figure 6?

12. In table 4 what is the difference between our dataset(2020) and the our dataset (2021)

13. In the conclusion, you said that “the paper provides a comprehensive study on the use of machine 681 learning algorithms to detect DDoS attacks” where you have used only three ML algrothims DT KNN and ANN.

14. Please see the following paper for more information:

''Performance Investigation of Principal Component Analysis for Intrusion Detection System Using Different Support Vector Machine Kernels''

Author Response

Dear Reviewer,

We have carefully considered each of your suggestions and made the appropriate changes to the manuscript. We have removed the section titled "A Quick yet Reliable Fix," renamed section 3.1 to "DDoS Overview," and added an abbreviated table to make it easier for readers to reference abbreviations and clarify terms such as TTL and ACL. We have also moved the figure caption under the figure, corrected the "Predicted model" spelling in Figure 1, and renamed Figure 2.

We apologize for the errors in our manuscript, including the incorrect reference to Figure 4 and the wrong table number. We have corrected these mistakes and checked all figures and table numbers to ensure they match the references in the text body.

We have added a sentence to clarify that "System setup and metrics" refer to the hardware and software used in our testbed experiments setup, as well as the evaluation metrics used to measure the performance of our machine learning models.

Once again, we thank you for your time and effort in reviewing our manuscript, and we hope that the revised version of our paper meets your expectations.

Sincerely,

Rana Abu Bakar

Author Response File: Author Response.pdf

Round 4

Reviewer 4 Report

No further comments is required

Review Reports

a.A feature reduction based reflected and exploited DDoS attacks detection system