# Two-Phase Deep Learning-Based EDoS Detection System
## 6 Result Analysis
### Quality of Service
#### 6.1.2 Evaluate the Flow Detector  
We then evaluated the detection performance of the flow detector. The flow detector is triggered after the period detector detects an attack and alerts the flow detector. The flow detector will detect which exact flow is abnormal. Figure 9 shows the detection performance in three EDoS attacks' common types of the four mentioned solutions: R-EDoS [15], [PERSON] et al. [13], NN-Abbasi et al., and our proposed scheme. The average results are presented in Table 8. These results show that regarding detection rate, accuracy, and F1-score, our proposed model accounts for the highest rate, 98.139%, 98.163%, and 98.163%, which is slightly higher than R-EDoS system and clearly outperforms the two solutions (SVM and NN) in [13]. With respect to false alarm rate, the proposed system dominates \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Accuracy** & **Detection Rate** & **False Alarm Rate** & **F1** \\ \hline ICMP flooding attck & 95.896\% & 94.208\% & 4.104\% & 95.831\% \\ TCP-SYN flooding attack & 96.439\% & 96.888\% & 3.561\% & 96.482\% \\ TCP-HTTP flooding attack & 95.723\% & 94.231\% & 4.203\% & 95.681\% \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Detection performance of the period detector in different kinds of EDoS attacks. the production of wrong warnings when it only accounts for 1.837%, while the false alarm rate of R-EDoS is 4.333%, SVM and NN are 13.779% and 21.113%, respectively. R-EDoS and our approach achieve much better results than SVM and NN in [13] because these two approaches learn from current and historical information of attackers. SVM and NN only observe and learn the attacker's information at the current time period. A normal TCP session sends the very first packets to the victim. Due to the short observation time, the collected TCP flow looks like a TCP SYN flooding flow. Consequently, the system in [13] will consider it as an abnormal flow. That proves recurrent neural network-based algorithms outperform other machine learning-based algorithms in EDoS attack detection. Figures 10 and 11 show the detection and response time results of the flow detector compared with [13; 15], respectively. The detection time and response time are two crucial metrics in evaluating an EDoS detection mechanism [18]. The detection time measures how quickly a new attack is detected. We simulated an SYN flooding attack with an attack rate of 7000 requests per second and calculated the detection time for each classified flow. The result in Figure 10 show that our flow detector outperforms the three other solutions in terms of the detection time metrics. In particular, compared with the R-EDoS method, our model only requires 0.54 s to detect each flow because our LSTM model only uses a sequential input data length of 5 instead of 100, which R-EDoS used for a GRU-based model. This shortens the calculation time of our proposed model compared to the GRU-based model in [15]. This also allows our model to outperform the three other methods in terms of the response time. The response time is defined as follows. The response time is the period when a cloud user makes a request, and one corresponding response is sent back to the user. Overall, the response times of our proposed model (varying within 21-29 ms) and R-EDoS, which are two variant forms of RNN algorithms, are similar and shorter than that of the SVM-based model and NN-based model [13]. Our proposed model, however, is better than R-EDoS in terms of response time (varying from 21-25 ms) because of a shorter sequential input data length. Figure 8: Detection performance of the period detector in different kinds of EDoS attacks. [PERSON] Resources Consumption  
In this section, we evaluate the efficiency of our proposed mechanism in terms of CPU usage and memory usage, which are two representative resource consumption metrics. Figures 12 and 13 show the results of the CPU and memory utilization, respectively.