# Two-Phase Deep Learning-Based EDoS Detection System
###### Abstract  
Cloud computing is currently considered the most cost-effective platform for offering business and consumer IT services over the Internet. However, it is prone to new vulnerabilities. A new type of attack called an economic denial of sustainability (EDoS) attack exploits the pay-per-use model to scale up the resource usage over time to the extent that the cloud user has to pay for the unexpected usage charge. To prevent EDoS attacks, a few solutions have been proposed, including hard-threshold and machine learning-based solutions. Among them, long short-term memory (LSTM)-based solutions achieve much higher accuracy and false-alarm rates than hard-threshold and other machine learning-based solutions. However, LSTM requires a long sequence length of the input data, leading to a degraded performance owing to increases in the calculations, the detection time, and consuming a large number of computing resources of the defense system. We, therefore, propose a two-phase deep learning-based EDoS detection scheme that uses an LSTM model to detect each abnormal flow in network traffic; however, the LSTM model requires only a short sequence length of five of the input data. Thus, the proposed scheme can take advantage of the efficiency of the LSTM algorithm in detecting each abnormal flow in network traffic, while reducing the required sequence length of the input data. A comprehensive performance evaluation shows that our proposed scheme outperforms the existing solutions in terms of accuracy and resource consumption. economical denial of sustainability; deep learning; cloud computing; long short-term memory; artificial neural network +
Footnote †: 2021: 11, 10249. [[https://doi.org/10](https://doi.org/10)]([https://doi.org/10](https://doi.org/10)). in [13] to resolve the issue caused by a hard threshold and decreased the high false-positive rate. However, this method does not achieve high accuracy. Moreover, the method in [13] only detects that there is an attack happening in network traffic and doesn't know which flow is abnormal. Because an EDoS attack is a type of slow rate attack, the attack rate looks similar to the legitimate network traffic from the victim-end during each time period. To efficiently detect this type of slow rate attack, it is necessary to trace or collect the historical information of the attack source. Considering that network traffic also has a sequential relationship in the time dimension, in [14; 15], two multivariate time-series data-based algorithms are proposed based on two variant forms of a recurrent neural network (RNN), i.e., a long short-term memory (LSTM) and a gated recurrent unit (GRU) to detect and mitigate the EDoS attacks in each network flow. These solutions achieve high accuracy by using a dynamic threshold that can reduce the high false-alarm rate. However, a disadvantage of an LSTM or other variants of an RNN in anomaly detection is the required long sequence length of the model, which requires the defense system to use such algorithms, increasing the calculation and detection times and consuming a large amount of computing resources. The LSTM model presented in [14] requires a sequence length of 250 for the input data. In some cases, the network traffic can contain a huge number of network flows. Because the systems in [14; 15] detects each network flow, the calculation time and the delay of these schemes will increase significantly. Understanding the above issues, we propose a two-phase deep learning-based EDoS detection scheme using the LSTM algorithm to detect and mitigate each abnormal flow; however, the sequence length of the LSTM model is significantly reduced. In the first phase, an artificial neural network (ANN) algorithm observes the network traffic within a time interval to check if there is an attack during that time period. We call the detector in the first phase the period detector because it detects the period under attack.