# A DNN Architecture Generation Method for DDoS Detection via Genetic Algorithm
## 4 Experiment and Evaluation
### Data Preprocessing  
The CICDDoS2019 dataset provides the network traffic data of pcap. However, this paper did not directly apply these data to the DNN. The CIC flowmeter tool is available from the Canadian Web Security Institute and uses this tool to process flow data from pcap files, extract the feature information of 87 of these data points, apply the processed feature information to the DNN and improve the efficiency of DNN updates. The other five datasets in this paper used the same method to extract features as input to the DNN. In addition to applying the tools mentioned above to process the data, experiments in this paper normalize and widen the data to enhance performance.  
* Remove invalid information from the input data: Some of the 87 features extracted by the CIC flowmeter tool should not be used as input features in the DNN. These are flow ID, time stamp, source IP, source port, target IP and target port. These features would all have different distributions in different application contexts and should not be taken as features to discern the abnormal flow of DDoS, which could otherwise cause overfitting problems in the DNN. Therefore, this paper removed these features in the data processing stage and chose other flow features as inputs to the DNN [43].
* Cleaning of datasets: This paper complemented the large number of NAN and INF in the raw data with the mean values of the other data.
* Transform labels in the manner of one-hot code: What was addressed in the experiment was a 2-Classification problem, so 1 x 2 one-hot coding was used to indicate the category of a piece of data [44].
* Data normalization processing: The normalization of the data can avoid numerically undesirable effects on the results because of the large difference in the orders of magnitude of the input data and is also convenient for the initialization of the DNN weights. Additionally, the data can be normalized to improve the speed of the gradient descent method for solving the optimal solution. This paper used the maximum-minimum Fmethod in the experiments to normalize the input data. The maximum-minimum method's formula is as follows: \[X_{norm}=\frac{X-X_{min}}{X_{max}-X_{min}}\] (10) where \(X_{norm}\) is the normalized data, X is the original data and \(X_{max}\) and \(X_{min}\) are the maximum and minimum values of the original dataset, respectively.
* Data expansion to solve the problem of uneven sample distribution: In the CICDDoS2019 dataset, there is a problem of an uneven distribution of sample data, in which the proportion of TFTP, SNMP and DNS traffic is significantly higher than other traffic. In the case of uneven data distribution in the dataset, the training and testing of the model are not objective [36; 37; 45]. In this paper, the dataset is expanded by the smote method. The smote method generates data through one piece of data and N pieces of data with the same category and the most similar features to avoid the over-fitting problem [46]. The formula generated by the smote method is as follows:  
\[S_{new}=S_{old}+RAMDOM(0,1)\times(S_{neighbor}-S_{old}) \tag{11}\]  
where \(S_{new}\) represents the expanded data, \(S_{old}\) represents the original data in the dataset and \(S_{neighbor}\) represents a piece of data with the same category and similar features as \(S_{old}\). Table 5 shows the proportion of each type before and after smote method processing.