# Detection of HTTP DDoS Attacks Using NFStream and TensorFlow
## 3 Methodology
### Dataset Creation
#### 3.1.2 Dataset Design  
Choosing the right dataset to build an AI model is the single most important factor influencing the accuracy of a given model. Several types of datasets were selected for use in this paper and were classified into two basic areas, as follows:  
* Attack
* Normal  
The \"Normal\" dataset consisted of measured samples used to verify the model used for learning. The \"Attack\" dataset consisted of attack samples that represented samples of inappropriate network traffic in the network under study. The study \"A Hybrid Deep Learning-Based Model for Anomaly Detection in Cloud Datacenter Networks [83]\" worked with the same distribution using the DARPA98 dataset [84]. At the start of the model \begin{table}
\begin{tabular}{l l} \hline
**Component** & **Value** \\ \hline CPU & 4x processor Intel (R) Xeon (R) CPU E5-4610 0 @ 2.40 GHz, with a total of \\  & 48 cores \\ \hline RAM & 278 GB \\ \hline GPU & None \\ \hline Operating System & Ubuntu 20.04 LTS \\ \hline Network adapter & Intel Corporation 82599 ES 10-Gigabit SFI/SFP+ \\ \hline \end{tabular}
\end{table} 
Table 2: Network traffic capture and store environment. \begin{table}
\begin{tabular}{l l} \hline
**Component** & **Value** \\ \hline CPU & Processor Intel(R) Core(TM) i7-3770 CPU @ 3.40 GHz \\ \hline RAM & 16 GB \\ \hline GPU & NVIDIA Corporation GA106 GeForce RTX 3060 graphics card \\ \hline Operating System & Ubuntu 22.04 LTS \\ \hline Network adapter & Internal/Build-in \\ \hline \end{tabular}
\end{table} 
Table 3: Machine learning building and training environment. training phase, both datasets were labeled. The samples were labeled with numerical labels as show on Table 4, according to the type of attack included in the given samples:  
Classifying these attacks into categories improved the focus on a particular attack when building the model. Each label contained several attack forms, focused on that area. The SYN flood attack consisted of the following patterns:  
* Syn_attack1.pcap--this sample contained a record of an attack directed from a device to a server using the High Orbit Ion Cannon (HOIC) application. The attack sample size was 8.3 MB. The attack was then logged using the Wireshark tool. * Syn_attack2.pcap--this sample contained a SYN attack log, in which multiple machines attacked a server, along with simulation of legitimate traffic. The attack sample size was 14 MB. The attack was then logged using the Wireshark tool. * Syn_attack3.pcap--this sample contained data from the SDN-DDOS-TCP-SYN dataset [85], created using the mininet generator; it contained the topology of 25 servers independently using the RYU controller. The attack was then logged using the Wireshark tool. The UDP flood attack consisted of the following samples:
* UDP_attack1.pcap--this sample contained a UDP flood generated against an HTTP service using the Low Orbit Ion Cannon (LOIC) application. The attack was performed from a single device against a single standalone web server supporting HTTP 3. The attack sample was 75 MB in size. The attack was then logged using the Wireshark tool. * UDP_attack2.pcap--this sample contained data from the \"BUET-DDoS2020\" dataset [86], where the UDP flood attack contained 125,774 UDP flood attack records. Only this form of attack was extracted from this sample. The attack sample size was 23.1 MB. The HTTP type attack consisted of several attack samples and variants: HTTP Flood, Slow Read, Slow Post, Slow Get, HULK attack, and Goldeneye attack. Most of these attacks were concentrated in a single sample, with multiple devices attacking a single server within a single measurement. The samples used were as follows:  
* http_attack.pcap--this sample contained a record of an attack against an HTTP server performed using the LOIC system. The attack was performed from a single simulated device against a single HTTP server. The attack sample was 91 MB in size. * HTTPDoSNovember2021.pcapng--this sample contained a record of network traffic generated by infected devices performing an HTTP DDoS attack.