# Detection of HTTP DDoS Attacks Using NFStream and TensorFlow
## 3 Methodology
### TensorFlow  
TensorFlow is a flexible library for numerical computation using graphs and data flow. With this library, neural networks and other machine learning models can be programmed and trained in an efficient way [89]. The underlying algorithms are optimized to use Nvidia CUDA tools, making it possible to achieve high computational parallelism using multiple devices. The TensorFlow library represents data in the form of tensors. Tensors are multidimensional arrays of data that actually flow as graphs from node to node. In fact,  
Figure 4: The recurrent neural network in TensorFlow. Figure 5: Recurrent Neural Network Model. such a graph can be described as a three-dimensional matrix, which need not be strictly mathematically defined [89]. Figure 6 shows a vivisection of a tensor. This tensor has multiple inputs in terms of data selection. Advantages of the TensorFlow library used in this work:  
* Great support for different machine learning models and tools for building neural networks. * The ability to generate any graph from the input data. The system is flexible in choosing the sets from which the data is plotted. * The system includes predefined mathematical functions for building neural network models. * Simple support for graphics accelerators is available, which can speed up the training of the model using multiple graphics cards. * It easily supports various operating systems, including Windows, Linux, Android and iOS. * It can be used flexibly for research or easy implementation in a production environment. * Auto-differentiation allows automatic computation of gradient-based machine learning algorithms, such as stochastic gradient descent. * There is support for the development in Python, in both Python 2 and Python 3 versions. When developing AI models, it is important to consider metrics that focus on the performance and efficiency of the model. Efficiency is highly dependent on high detection rates and low false positive or false negative rates [91]. However, it is also possible to measure these systems using other methods, such as measuring system power consumption, memory consumption, computational intensity of the models, and other parameters [92]. The N-level detector is usually evaluated in terms of accuracy, where several terms can be defined [21]: True Positive (_TP_), True Negative (_TN_), False Positive (_FP_), False Negative (_FN_). \[Overall Accuracy=\frac{TP+TN}{TP+TN+FP+FN} \tag{1}\]  
\[Sensitivity(Recall,TruePositiveRate)=\frac{TP}{TP+FN} \tag{2}\]  
Figure 6: The vivisection of Tensor. \[Specificity(Selectivity,TrueNegativeRate)=\frac{TN}{TN+FP} \tag{3}\]  
\[Fallout(FalsePositiveRate)=\frac{FP}{TN+FP} \tag{4}\]  
\[MissRate(FalseNegativeRate)=\frac{FN}{TP+FN} \tag{5}\]  
\[Precision=\frac{TP}{TP+FP} \tag{6}\]  
\[F1=\frac{2*TP}{2*TP+FP+FN} \tag{7}\]  
Figure 5:0  
Based on these concepts, the model can be evaluated using different metrics. Based on the aforementioned metrics, designed for the classification component of the detector, it is also possible to perform the analysis globally. Based on the global analysis, the whole system and model is evaluated from the input data, including training, to its output in the resulting system model [72]. For these purposes, the following parameters can be defined:  
* Packet Loss Ratio (%)
* Normalized Routing Load (Packets)
* Average End-End Delay (Seconds)
* Average Energy Dissipation (Joules)
* Malicious Drop (Packets)
* False Detection (%)
* Send Buffer Drop (Packets)  
When training a model, it is necessary to define how to measure its errors. These errors can be called a loss function, where the goal is to find appropriate parameters that minimize the percentage of errors [72]. The cross-entropy loss function can be defined as follows [93]:  
Figure 5:1  
Architecture for Dataset Analyses  
The network traffic datasets prepared for the purpose of building a model using TensorFlow, were stored in PCAP format. However, this format cannot be used optimally to train a model aimed at finding network traffic anomalies.