# Detection of HTTP DDoS Attacks Using NFStream and TensorFlow
## 6 Conclusions and Future Perspectives  
The primary research described herein focused on anomaly detection in HTTP traffic in computer networks using machine learning and the TensorFlow library. The aim of this paper was to investigate the accuracy of using TensorFlow, a well-known machine learning library, to detect anomalies in HTTP traffic. The results of our work showed that TensorFlow can be used to effectively identify anomalies in HTTP traffic, and that it can be used in conjunction with other machine learning techniques to improve the accuracy of anomaly detection, as described in Section 4 One of the main advantages of using TensorFlow and nftstream for anomaly detection is the ability to analyze large samples of network flow or other complex data structures. This makes them suitable for analyzing network traffic, which is often a time-consuming and complex task. The results of detection accuracy and loss as a function of the number of epochs are described in Section 4. The results are shown in Figures 9 and 10, and it can be observed that the created model achieved a success rate of 92% and 96% in the second experiment. During the measurements, three models were tested, wherein data with different amounts of attack data were entered as test data. The model was able to achieve an accuracy of 92.85% under test conditions when testing normal and abnormal network traffic. This experiment described real network traffic, while experiment No.3 described traffic without attacks, where the model recorded 3.05% of flows as anomalous. The measured dataset contained only data without attacks. The experimental results confirmed the high accuracy of 96.5% classification of LSTM models when using datasets created using nftstream. Compared to other methods of packet analysis, the accuracy was 1.4% lower, to the disadvantage of our created model. The created model and the created infrastructure could be used in the future with essential attributes to increase the accuracy of anomaly detection. The goal of the experiment was to create a model that, using defined anomaly samples, could detect anomalies in HTTP traffic with high accuracy. This could be implemented in practice for the quick search and detection of anomalies in HTTP network traffic, while the infrastructure could be automated. The results of the measurement in practice showed that the model created from known samples was prone to falsely positive labeled samples. This problem can be minimized by increasing the number of epochs when training the model. Another key advantage of using TensorFlow for anomaly detection is its ability to adapt to emerging patterns of packet behavior in the network. As network traffic patterns can change over time, it is important that the anomaly detection system can adapt and continue to detect anomalies despite the changes. TensorFlow's ability to learn and adapt to new data patterns makes it well suited to this task. There are also some limitations to using TensorFlow for anomaly detection. One limitation is that TensorFlow requires a significant amount of data to train and test the model. In addition, TensorFlow requires a significant amount of computational resources to run. Despite these limitations, the results showed that TensorFlow can be an effective tool for anomaly detection in HTTP traffic. Its ability to analyze large datasets with complex data structures, as well as its ability to adapt to changing data patterns, makes it suitable for this task. Furthermore, its ability to perform deep learning makes it suitable for detecting complex anomalies. Our study describes the practical use of a combination of machine learning and nfstream probe, which enables the analysis of network traffic in real operations. The model we propose in this study contributes by creating its own dataset with attacks on the HTTP server. Other researchers can also use this dataset in future works. The created model focuses on increasing the reliability of, and reducing the error rate of, the trained model in detecting attacks in networks.