# Detection of HTTP DDoS Attacks Using NFStream and TensorFlow
## 3 Methodology
### Building the Model  
The idea behind this work was to use sequential information, which, using traditional neural networks, assumes that all inputs and outputs of the model are independent of each other. Therefore, we used RNN recurrent neural networks, as these perform training for each element independently, while the result is strictly dependent on the previous results [32]. The basic step in building the model was to unify the data used in the training process. We stored the data converted using nfstream in separate CSV files containing NETFLOW records with the labels added. These records may also contain, in multiple files, different data, produced by the nfstream application. Then, we extracted uniform data from these records and normalized them to have the same number of parameters for each flow solution. If a parameter was missing in any of the samples, the application added the predefined value, i.e., 0. In this way, we ensured that the model building process would work with equally sized matrices of data, thus eliminating the potential risk of inaccuracy or miscalculation. When building the model, we used the following data from the nfstream application:  
\"src_port\",\"dst_port\",  
\"src2 dst_packets\", \"src2 dst_bytes\",  
\"dst2 src_packets\", \"dst2 src_bytes\",  
Figure 7: Data classification.  
\"src2 dst_min_ps\",\"src2 dst_mean_ps\",\"src2 dst_stddev_ps\",\"src2 dst_max_ps\",\"dst2 src_min_ps\",\"dst2 src_mean_ps\",\"dst2 src_stddev_ps\",\"dst2 src_max_ps\",\"src2 dst_min_piat_ms\",\"src2 dst_mean_piat_ms\",\"src2 dst_stddev_piat_ms\",\"src2 dst_max_piat_ms\",\"dst2 src_max_piat_ms\",\"dst2 src_mean_piat_ms\",\"dst2 src_stddev_piat_ms\",\"src2 dst_syn_packets\",\"src2 dst_cwr_packets\",\"src2 dst_ece_packets\",\"src2 dst_urg_packets\",\"src2 dst_ack_packets\",\"src2 dst_psh_packets\",\",\"src2 dst_rst_packets\",\",\"dst2 src_syn_packets\",\"dst2 src_cwr_packets\",\"dst2 src_ece_packets\",\"dst2 src_urg_packets\",\"dst2 src_ack_packets\",\"dst2 src_csk_packets\",\"dst2 src_psh_packets\",\"dst2 src_rst_packets\",\"dst2 src_rst_packets\",\"dst2 src_fin_packets\",\"src_port\",\"dst_port\"  
Figure 8 shows the algorithm of the code. It can be divided into five main phases as shown on Table 5:  
The initialization phase of the program defines the parameters required by the algorithm, as well as defining the constants required for the subsequent steps of the code. In this phase, we also stored the necessary datasets, which served as model training and validation data, respectively. In the data pre-processing phase, the uniform samples were loaded and categorized into the desired form. The next phase was the model implementation phase, where the implementation of the f  
Figure 8: The TensorFlow algorithm phases.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Phase No.** & **Phase Description** \\ \hline Phase 1 & Initialization phase \\ \hline Phase 2 & Data pre-processing phase \\ \hline Phase 3 & Model implementation phase \\ \hline Phase 4 & Model iteration phase \\ \hline Phase 5 & Model verification phase \\ \hline \hline \end{tabular}
\end{table}
Table 5: The TensorFlow algorithm phases.  
the weights and biases specified for the model nodes were randomly generated. This was followed by the implementation of the training algorithm, where the algorithm was trained on the required data. This phase depended on the iteration phase, where the learning process was repeated after a certain number of iterations in order to train the given model more accurately. The functionality of the model was then verified. Using test functions, the model was loaded and subjected to test data, comparing the accuracy of the untrained model used in the data analysis process. Parameters on Table 6 were used to train the experimental model: