# Detection of HTTP DDoS Attacks Using NFStream and TensorFlow
## 1 Introduction  
In today's digital world, cybersecurity has become a key concern for individuals, businesses and organizations. As the number of online threats and attacks continues to grow, it is essential to implement effective security measures to protect sensitive information and prevent attacks in cyberspace. Distributed Denial of Service (DDoS) attacks are among the most common and damaging cyber attacks, as they can disrupt the normal operation of HTTP networks, resulting in financial losses and reputational damages. DDoS attacks involve multiple computers or devices flooding a targeted website or an entire network with requests [1]. As a result, the network becomes overloaded and unavailable to users. In works focused on the detection of DDoS attacks, the authors describe the methods of DDoS attacks that can be used. They also point to the fact that the power of DDoS attacks grows exponentially with time [2; 3]. Typically, these attacks are launched by botnet networks of infected computers, remotely controlled by cyber criminals. DDoS attacks can be particularly damaging to HTTP networks, which are widely used to access and share information online. To detect anomalies and DDoS attacks, researchers propose several methods, such as the implementation of statistical methods to detect attacks, and the implementation of IPS/IDS systems and also the possibility of using machine learning to detect an attack. In one such work, the authors described various methods of detecting DDoS attacks using machine learning, such as creating a machine learning model using the SVM algorithm. However, in our opinion, only a small amount of data was used to create the model. The accuracy of the model reached over 98%, but when using real threats, the results did not reach such accuracy, due to the lack of additional information [4; 5; 6; 7; 8]. A critical step in preventing DDoS attacks on HTTP networks is to detect them before they can cause any significant damage. In recent years, several methods and techniques have been developed to detect DDoS attacks on HTTP networks so that organizations can take immediate action to mitigate the impact of these attacks. One of the most effectivemethods of detecting HTTP DDoS attacks is traffic analysis. This involves analyzing network traffic patterns and looking for traffic anomalies or spikes that may indicate a DDoS attack [9; 10]. DDoS attacks often involve sudden spikes in traffic from multiple sources, making them easier to detect through traffic analysis. Another method of detecting HTTP DDoS attacks is to analyze the server logs. When analyzing server logs, the goal is to identify unusual traffic patterns, such as sudden spikes in the number of requests from a particular IP address or sudden spikes in traffic to a particular URL [11; 12; 13]. We consider the lack of various technologies aimed at detecting incidents in a relatively quick time to be important gaps in the research. The time taken to detect incidents depends on the detection capabilities of the machine learning choice, the creation of the model, the choice of technology for data analysis, and also on the size and quality of the data sample. By implementing our own data source, we wanted to focus on detecting attacks in a faster time. This problem is solved in a large number of works focused on cyber security [2; 4; 14; 15]. Other ways of detecting DDoS attacks include the use of intrusion prevention systems (IPSs) and intrusion detection systems (IDSs) [16; 17; 18]. An IPS monitors network traffic and automatically blocks traffic that is considered malicious, while an IDS alerts security personnel to potential security threats. The IDS and IPS systems can be combined to detect HTTP DDoS attacks [16; 19; 20]. An IDS can analyze network traffic to find patterns that may indicate a DDoS attack, such as a large number of requests coming from a single IP address or an unusual amount of traffic from a particular region.