# Detection of Unknown DDoS Attacks with Deep Learning and Gaussian Mixture Model
## 2 Related Works  
Various ML technologies have been employed, mainly as classifiers, in the detection of DDoS attacks. These include Support Vector Machines (SVM), k-Nearest Neighbors (KNN), the Naive Bayes Classifier, Random Forest (RF), Density-Based Spatial Clustering of Applications with Noise (DBSCAN), and Artificial Neural Networks (ANNs), to name a few. With SVM, based on labeled training data, a hyperplane is constructed in the transform domain to classify unseen data. [PERSON] has built an IAI (IP Address Interaction Feature) model that can effectively discriminate normal from abnormal flows in traffic streams and helps to identify attack flows quickly and precisely [9]. In KNN, \(k\) nearest neighbors of incoming data are located. A majority of these \(k\) neighbors decide the classification of the incoming data. [PERSON] has applied KNN [10] to classify the state of networks according to each stage of DDoS attack and obtained optimistic results. A Naive Bayes classifier is a classification technique based on [PERSON] theorem assuming independence among predictors. A Naive Bayes classifier assumes that the presence of a particular feature in a class is unrelated to the presence of any other feature. [PERSON] used the NB method [11] to predict the existence of DDoS attacks based on the mean and standard deviation of network packets and achieved precise results. An RF is a collection of decision trees. The majority of the outcomes of individual decision trees determine the classification. In [12], [PERSON] et al. proved that with well-computed key features in DDoS data, experimental results show an RF algorithm can attain valid classification performance and an optimal feature subset. DBSCN finds core samples of high density and expands clusters from them. It particularly suits data that contains clusters of similar density. [PERSON] used a DBSCAN clustering algorithm [13] to deal with diversity in attack vectors. The proposed system worked well with chosen attributes in their experiments. ANNs emulate biological neural networks. Given label data, ANNs learn the mapping function using the back-propagation algorithm. [PERSON] proposed an ANN-based DDoS detection method that provided 99.8% detection accuracy in recognizing DDoS attacks [14]. There are also successful stories for DL in DDoS detection. [PERSON] and [PERSON] [15] combined Long Short-Term Memory (LSTM) and Bayesian methods to detect DDoS attacks. LSTM is suitable for events with long intervals and delays in the time domain. In other words, LSTM can control the value of the indefinite length of time and decide whether the information should be retained or removed. The author used LSTM to identify the confidence index of DDoS attacks and further used the Bayesian method to make a second judgment to improve detection accuracy. [PERSON] et al. [16] adopted the autoencoder for the detection of DDoS attacks. Autoencoder is a multi-layer neural network with an unsupervised training algorithm. It removes less relevant information and noise during the training process and retains essential information. [PERSON] et al. [17] employed CNN in their detection system, named LUCID, featuring a dataset-agnostic preprocessing mechanism and an activation analysis. The proposed LUCID has 40 times of reduction in the processing time, rendering it well-suited in resource constrained environments. [PERSON] et al. [18] applied machine learning models to detect webshell to build secure solutions for IoT networks. Ensemble methods, including random forest (RF), extremely randomized trees (ET), and Voting, are used to improve the performances of these machine learning models. Their findings show that RF and ET are suitable for lightweight IoT scenarios, and the Voting method is effective for heavyweight IoT scenarios. [PERSON] et al. [19] propose an efficient malware detection system based on deep learning.