# Detection of Unknown DDoS Attacks with Deep Learning and Gaussian Mixture Model
## 1 Introduction  
By flooding malicious traffic, DoS (Denial of Service) attacks deplete the network bandwidth and computing resources of a targeted system, preventing the target system from offering regular services to legitimate users. DDoS (Distributed Denial of Service) [1] goes even further on a much larger scale. DDoS attacks take over the control of a large number of comprised systems, called a botnet, and launch coordinated attacks on the victim system, as illustrated in Figure 1. Along with the emergence and advancement of disruptive Internet technologies, DDoS attacks are evolving and proliferating in scale, frequency, and sophistication. Organizations face potential threats to their network environment that may cause severe impacts to their operations, such as business downtime, data breaches, or even ransom demands from hackers [2]. Upon the occurrence of DDoS attacks, actions for DDoS mitigation should be taken, as suggested in [3]. The detection of DDoS attacks is essential before any mitigation approaches can be taken. In the early era, the alarm of DDoS attacks was triggered by rules programmed by traffic engineers. This approach apparently failed to catch up with the dynamic and evolving natures of DDoS attacks. As ML/DL (Machine Learning/DeepLearning) unleashes their great potential in different fields, academics and industries are exploring the possibility of applying ML/DL to DDoS detection. Traditional manual methods suffer from low accuracy and long latency problems in risk identification. With ML approaches, such as Naive Bayesian, KNN, and Random Forest, threats can be captured more quickly and more accurately [4]. In ML, features for classification must be selected by human experts or by certain feature selection schemes. On the other hand, feature selection is an integral part of DL. Deep Learning models such as CNN and RNN are built based on a series of nonlinear processing layers to learn many levels of data representation from a large volume of labeled samples. Therefore, DL can serve as a powerful tool for DDoS detection [5]. Some successful stories of ML/DL use for DDoS detection will be reviewed in Section 2. After exploring several alternatives, we employ the Bi-Directional Long Short-Term Memory (BI-LSTM) [6] DL architecture in this study. BI-LSTM is capable of capturing essential characteristics of DDoS traffic, in particular, the time domain correlation. Experiments show that it serves well for the intended purpose. ML and DL have proven themselves effective solutions to the detection of DDoS attacks. However, they are trained to recognize only instances drawn from the distribution models constructed from the training set. Thus, they could fail in cases they have never learned. To know what one doesn't know is the problem called the Open Set Recognition (OSR) problem [7]. This problem has a severe impact on the detection of DDoS attacks since DDoS attacks' technology keeps evolving and results in changing traffic characteristics. A Gaussian Mixture Model (GMM) [8] is incorporated into our framework to differentiate trained samples and novel instances. Unknown traffics captured by the GMM are then subject to discrimination and labeling by traffic engineers, and then fed back to the framework as additional training samples in the incremental learning phase. The main contributions of this paper are summarized as follows:  
* We identify the detection of unknown DDoS attacks as an Open Set Recognition problem and demonstrate its impact on conventional detection approaches. * We propose a new BI-LSTM-GMM model to detect the unknown network attack. The proposed framework can successfully differentiate novel instances from samples drawn from trained models. * Using the data sets CIC-IDS2017 and CIC-DDoS2019 for training, testing, and evaluation, experiment results show that the proposed BI-LSTM-GMM can achieve recall, precision, and accuracy up to 94%. Figure 1: DDoS attack with a botnet. The rest of this paper is organized as follows.