# Detection of Unknown DDoS Attacks with Deep Learning and Gaussian Mixture Model
## 4 Experiments
### BI-LSTM-GMM with Incremental Learning  
With GMM, traffics never learned can be picked up and logged. In the proposed framework, an instance three times of deviation away from the mean, i.e., \(x\leq\mu-3\rho\) or \(x\geq\mu+3\rho\), is considered a novel instance. It will be logged and labeled by traffic engineers. The intervention of data engineers is required since a novel instance can be malicious traffic, or equally likely, a new type of legitimate traffic. Collected, labeled new instances are fed back to the BI-LSTM and the GMM in the incremental learning phase. Table 5 reports the results after the completion of the loop. Compared with Table 4, the detection rate of unknown traffic, the \"CIC-IDS2017/Friday\" is greatly improved, both in its recall and accuracy. Notice that the detection of the old attack, CIC-IDS2017/Friday, slightly degrades. This is a side effect of incremental learning. An existing model will be biased by the incremental training data set and move in the feature space. We also let data sets in \"CIC-DDoS2019\" play the role of unknown attacks to examine the general behavior of the proposed framework. The results are summarized in Table 6. Unknown traffic is the primary source of mis-classification. As shown in Table 5, the pure BI-LSTM is unable to address unknown attacks correctly. The recall indicator declines dramatically due to unknown traffic. There is a consistent tendency that the BI-LSTM alone failed to handle unknown traffics adequately. However, the GMM is capable of filtering new instances that were not learn beforehand. As indicated in Table 6, the integration of BI-LSTM and GMM can be an effective solution to the Open Set Recognition (OSR) problem in detecting unknown attacks. With the help of traffic engineers, labeled new instances are fed back to the BI-LSTM and the GMM for incremental learning. The updated model can then deal with both the old traffic and the new traffic correctly and gracefully. Referring to Table 6, the performance degradation of CIC-DDoS2019/NetBIOS is not so profound. It could be that its traffic pattern resembles that of CIC-IDS2017/Wednes-day. The performance of CIC-DDoS2019/NTP and CIC-DDoS2019/LDAP is much more evident. However, with the help of the proposed BI-LSTM-GMM framework together with the incremental learning scheme, all performance indices return to satisfactory levels. The proposed framework has demonstrated optimistic results in the detection of unknown DDoS attacks. However, several issues demand further investigation for its universal applicability. The first issue relates to the test datasets. Validation on more \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Model** & **Test Data Set** & **Recall** & **Precision** & **Accuracy** & **AUC** & **F1** \\ \hline BI-LSTM & CIC-DDoS2019/NetBIOS & 0.898 & 0.999 & 0.898 & 0.853 & 0.946 \\ BI-LSTM-GMM & CIC-IDS2017/Wednesday & 0.995 & 0.736 & 0.868 & 0.836 & 0.846 \\ BI-LSTM-GMM & CIC-DDoS2019/NetBIOS & 0.982 & 0.999 & 0.980 & 0.967 & 0.990 \\ \hline BI-LSTM & CIC-DDoS2019/NTP & 0.362 & 0.995 & 0.368 & 0.606 & 0.531 \\ BI-LSTM-GMM & CIC-IDS2017/Wednesday & 0.985 & 0.750 & 0.875 & 0.850 & 0.852 \\ BI-LSTM-GMM & CIC-DDoS2019/NTP & 0.932 & 0.987 & 0.923 & 0.927 & 0.959 \\ \hline BI-LSTM & CIC-DDoS2019/LDAP & 0.392 & 0.999 & 0.392 & 0.568 & 0.563 \\ BI-LSTM-GMM & CIC-IDS2017/Wednesday & 0.999 & 0.872 & 0.946 & 0.909 & 0.931 \\ BI-LSTM-GMM & CIC-DDoS2019/LDAP & 0.956 & 0.996 & 0.953 & 0.948 & 0.976 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Performance of the BI-LSTM and BI-LSTM-GMM with “CIC-IDS2017/Wednesday” as the old traffic and “CIC-DDoS2019” as the new traffic. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Test Data Set** & **Recall** & **Precision** & **Accuracy** & **AUC** & **F1** \\ \hline CIC-IDS2017/Wednesday & 0.953 & 0.895 & 0.942 & 0.930 & 0.923 \\ CIC-IDS2017/Friday & 0.998 & 0.979 & 0.982 & 0.966 & 0.988 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Performance of the BI-LSTM-GMM with incremental learning.