# Detection of HTTP DDoS Attacks Using NFStream and TensorFlow
## 2 Background and Related Work
### Further Research  
Increasing the security of various areas of IT is of paramount importance today. As a result, there is a growing need to find new methods and technologies that can identify different types of threats on their own. This is why machine learning has become a popular topic and many researchers have been exploring its potential applications in a number of research areas. One such area is the use of machine learning in networks implementing the HTTP protocol, as machine learning can help optimize network performance, improve network security and respond flexibly to changes in the network [55; 56]. In various works [57; 58; 59], the authors describe the use of machine learning in the optimization of network flows. These methods are used to optimize network traffic that uses a lot of bandwidth or is burdened by a DDoS attack on HTTP protocols. They used a neural network to analyze network traffic data and then used the predictions to adjust network resources in real time. The result was a significant improvement in network performance, with a reduction in response time and an increase in network throughput [57; 58; 59]. Other research describes the use of machine learning to detect attacks and anomalies. The studies mostly focus on the detection of DDoS attacks where the authors use machine learning and algorithms to detect these attacks. In these papers, the authors describe the use of machine learning in combination with pre-prepared attack samples that serve to train the model. The datasets created in this way can also be expanded with datasets that are output from IPS and IDS tools. This technique is described in the articles dealing with the automatic detection of attacks and the creation of automated protection against these attacks. All these works agree on the need to use machine learning in the detection of anomalies and attacks on the measured network [60; 61; 62; 63]. Another problem encountered in networks is the method of detecting network traffic. Researchers describe the use of the net flow protocol, which provides data for the creation of the code. However, this protocol depends on the device that is used, so it depends on the device's router. The most common problem that is described in the works is the absence of a protocol to actually implement machine learning models directly in the detection process. Network traffic sampling is also a problem. This problem was solved by the researchers dealing with Heavy-Hitter by implementing the actual flow device. This flow device enables the implementation of machine learning in the analysis process as well as within its own rules. Researchers opiate the narrowness of machine learning models, such as KNN, SVM, DBSCAN. The most used method is that of KNN networks [64; 65; 66]. Another use of machine learning in HTTP networks is the detection of XSS attacks and other similar network attacks. The researchers describe the use of machine learning algorithms to detect these attacks from selected LOG files that record user accesses to the system's WEB interface. Such information can extend protection and block potential attackers who can bypass basic protection. The papers also describe the possibility of detecting these attacks using byridic detection models. The researchers proposed the use of the ABC-AFS system, which implements the advantages of IDS and machine learning. The work describes the use of hybrid classification methods based on Artificial Bee Colony (ABC) and Artificial Fish Swarm (AFS) algorithms. Fuzzy C-Means Clustering (FCM) and Correlation-based Feature Selection (CFS) techniques are used to divide the training data set, and the tame data set is removed, as it is irrelevant [67; 68; 69]. The rapid development of 5g technologies also leads to the rapid spread of DDoS attacks in 5g network environments. The work \"Composite and efficient DDoS attack detection framework for B5G networks\" [70] describes the narrowing of machine learning for the detection of DDoS attacks taking place in 5G networks.