# Two-Phase Deep Learning-Based EDoS Detection System
## 4 System Design
### An Objective and System Design Analysis  
Cloud consumers are typically monitored using a multivariate time series, whose anomaly detection is critical for service quality management [14]. For instance, as shown in Figure 3, the parameters of a cloud instance, such as CPU utilization and memory consumption are collected and tracked by a network administrator. When an EDoS attack is launched, the parameters of the cloud consumer will suddenly change in value. An EDoS attack is similar to a low-rate DDoS attack in terms of the characteristics [18]. The networking traffic launched by this attack is not changed too dramatically during each time period, similar to a conventional DDoS attack. As discussed in [14; 15], an LSTM or a GRU, two variant forms of an RNN, are chosen for EDoS detection. These algorithms are not only able to learn from historical data but also to simultaneously keep track of the multivariate time series data to detect an EDoS attack. These methods will collect the sequential multiple variables information of the attacker at each observation and learn not only the past values of each variable but also the correlation information between variables. Nevertheless, the complexity of the model is a limitation of these algorithms. The algorithms also require a long sequence of input data. The sequence length can be 100 or longer (in [14], 250-sequence-length input data are required). This increases the calculation time overhead and response time of the entire system. In particular, the calculation time required to detect each flow is even longer. Thus, in this paper, a two-phase deep learning-based mechanism is proposed to overcome this limitation of an LSTM in EDoS attack detection. The first phase in the proposed two-phase scheme is a period detector. The period detector will detect if an EDoS attack has occurred within an observed time period. An ANN is the core algorithm in the period detector. The second phase is a flow detector. This phase will accurately filter out abnormal flows. LSTM is the core of the flow detector. The aim of the period detector is to reduce the sequence length of the input data for the LSTM model in the flow detector. If we use the flow detector directly, we require a hundred or longer sequence length of the flow feature input data for each flow to fit the model, because the model cannot know when an abnormal time has occurred where it is the most important part of a long sequence of input data. Using the period detector before a flow detector, we can know when an attack happened and where the most important part of a long sequential input data is for an LSTM model. By doing so, we can reduce the sequential length of the input data for the LSTM, especially in the case that network traffic can contain a huge number of normal flows. If we only use the flow detector, the calculation time and response of the system can increase much more highly but not necessarily to detect each network flow. In brief, the period detector helps reduce the calculation time of the flow detector. Figure 4 depicts an overview of our proposed mechanism aimed at detecting EDoS attacks. This conceptual architecture includes four main modules: a raw data processing scheme, a period detector, a flow detector, and a firewall. The system workflow and mission of each module will be explained in detail in the next sections.  
Figure 3: Multivariate time series snippet visualization with an anomalous region highlighted.