# Detection of HTTP DDoS Attacks Using NFStream and TensorFlow
## 4 Results  
The goal of this experiment was to investigate the efficiency of using a recurrent neural network (RNN) with TensorFlow to detect anomalies in HTTP traffic. Detecting anomalies in network traffic is an important task in identifying potential security threats, such as network intrusions or DDoS attacks. To conduct the experiment, a set of data was collected from a simulated network focusing on the network traffic on the HTTP network. This dataset consisted of normal network traffic and various types of anomalous traffic, including DDoS attacks on HTTP services. The normal traffic was generated by simulating user behavior when browsing web services, while the anomalous traffic was generated by simulating various types of attacks using the tools available in the toolkit described in this paper. The total number of network flows recorded in this experiment was 985,054. The flows were then separated into the training and testing of the model, as is shown in the following Table 7.  
The RNN was trained on the dataset using TensorFlow. The network consisted of six interconnected layers, with the first layer being the Long Short-Term Memory (LSTM) layer. The LSTM layer was used to capture time-dependent features of the network traffic, while the remaining layers were used to classify the traffic as either normal or anomalous. Figure 9 shows the model accuracy as a function of the number of training epochs. From a \begin{table}
\begin{tabular}{l l} \hline \hline
**Parameter** & **Value** \\ \hline Epoch & 300 \\ \hline Hidden Layers & 7 \\ \hline Activation function & ReLu \\ \hline Optimizer & adam \\ \hline Classification engine & softmax cross entropy between logits and labels \\ \hline Neurons on each layer & 40 \\ \hline Learning Rate & 0.001 \\ \hline Embedding size & 2 \\ \hline Class size & 17 \\ \hline One hot encoder & Yes \\ \hline Weights & Random \\ \hline Biases & Random \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Parameters used in training the experimental model. \begin{table}
\begin{tabular}{l l} \hline \hline Total number of transactions & 985,054 \\ \hline Number of Normal transactions & 394,021 \\ \hline Number of Attack transactions & 591,032 \\ \hline Number of test transactions & 587,621 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Dataset detail. training perspective, increasing the number of iterations in the machine learning process leads to an increase in the accuracy of the model. Similarly, the accuracy of the validation of untrained data also increases. During the first 50 iterations, the accuracy of the untrained model increased quite rapidly, as the model validation accuracy increased from 0.72 to 0.79. However, further increases in the number of repetitions did not result in an increase in accuracy. Figure 10 shows the training loss as a function of the number of training iterations of the model. As can be seen from the results above, the training loss decreased as the number of epochs increased. This indicated that the model was learning and improving over time. We used the model developed on untrained data in a simulated environment consisting of an nfrstream probe that could classify the network traffic based on the machine learning model. This model evaluated packets in real time from prepared smaller samples of various attacks and simulated legitimate network traffic. The sample show on Table 8 consisted of 587,621 flows that were subsequently analyzed by this model. Figure 10: Training loss for TensorFlow algorithm. \begin{table}
\begin{tabular}{l l} \hline \hline Details of the test dataset Number of test transactions & 587,621 \\ \hline Number of Normal transactions & 397,685 \\ \hline Number of Attack transactions & 189,936 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Details of the test dataset. Figure 9: Training and validation accuracy for TensorFlow algorithm. After performing the analysis using nfstream and the developed machine learning model, we were able to classify network traffic in real time, with minimal delay.