# Detection of HTTP DDoS Attacks Using NFStream and TensorFlow
## 2 Background and Related Work  
The definition of DDoS attacks varies from source to source. This type of attack can be defined as the use of an extremely large volume of packets by an attacker against his/hertarget through the mutual cooperation of a large number of distributed systems connected to the Internet as shown in Figure 1[34]. According to this definition, users are denied legitimate access to the target system by consuming the entire network bandwidth and an excessive amount of system resources. Considering the business aspect of DDoS attacks, as described by [PERSON] [35], these attacks are carried out using remotely controlled external computer botnets to launch attacks on the critical online services of companies on the Internet. Currently, there are several types of advanced DoS attacks, namely, UDP Flood, ICMP Flood, TCP Flood, HTTP Flood and HTTPS Flood [36; 37; 38; 3; 3]. We can group them based on their protocols, such as UDP, TCP, HTTP and ICMP attacks. An attack can be easily classified, based on the methods used. DoS attacks have a wide range of methods used. However, they usually have similarities that flood the network with packets [39]. When comparing the most used machine learning methods in other works [3; 3; 8; 31], the attack was divided into four points. The first point is the attacker himself or herself, and the second point is the victim. The third point represents the hosts that generate a large number of requests towards the target of the attack. The last point is the target of the attack. If all these points are met, the attack is successful. The goal is to eliminate the attack in the phase where the attacker is still choosing where to attack. In analyzing and comparing the research efforts, we chose to focus on the use of machine learning, which can successfully detect any anomalies that arise. Within the comparisons, we focused on two points by which we evaluated the models. The first aspect was the accuracy of the model to react to the anomalies that arose, and the second aspect was the speed with which the given model can be trained for new threats. Within our analysis, we dropped the RNN, CNN, KNN, SVM, DBSCAN, DGN, Q-Learning models. In the analysis of machine learning, the focus was further on the use of RNN and CNN algorithms, where the detection success was above 94% in the papers. The authors described these algorithms as the most suitable for classifying network flows. During the analysis, we also considered special types of networks, such as LTSM networks, and also other combinations of LTSM-NB, CNNLTSM, from papers wherein the authors describe LTSM models as advantageous in tasks where it is necessary to implement a longer time dependence of data, which increases accuracy and speed [3; 3; 39; 40; 41; 42; 43; 3]. With a DDoS attack, it is necessary to focus on a longer period of time for the given attack. These attacks can be carried out in two ways [34; 44; 45]:  
* Draining system resources by consuming all allocated bandwidth and system resources. * Finding and triggering a failure in the targeted system. Most commonly, this means finding vulnerabilities in application servers and operating systems. These vulnerabilities are then exploited to deny access or to cause damage to the attacked application server. Authors of scientific research papers place the greatest emphasis on creating the right dataset that contains the necessary number of samples. The authors present the possibilities of creating a dataset of different sizes and properties using chi2, information retrieval scores, backward elimination and other methods. They also focus on KNN models that  
Figure 1: Example of a DDoS attack. have been compared using different datasets. They used KNN models and optimized the \"K\" value for different algorithms. While for DS00_Full they achieved a detection accuracy of 92.95%, for DS02_Chi2 93.08%, DS03_IG 93.36%.