Coverage-Aware Gradient-Boosted Intrusion Detection for Smart-Meter Distributed Denial-of-Service Resilience - Supplementary Materials

This study presents a system-level intrusion-detection methodology integrating coverage-aware sensor placement with leakage-controlled gradient-boosted classification. The contribution lies in combining monitoring visibility, training-only feature sanitization, duplicate and cross-partition overlap removal, false-positive-constrained threshold selection, repeated external testing, and a validated feature-budget mode.

Seventeen CIC-DDoS2019 parquet files were analyzed. After removing conflicting labels, exact duplicate feature vectors, and 4,666 testing records overlapping the training partition, the final dataset contained 121,088 training records and 297,790 external testing records with 60 predictors. Across 10 paired random-seed runs, XGBoost achieved mean accuracy 0.97707, precision 0.99991, recall 0.97258, F1-score 0.98606, receiver operating characteristic area under the curve 0.99944, Matthews correlation coefficient 0.92450, and false-positive rate 0.00044.