# Effective and Efficient DDoS Attack Detection Using Deep Learning Algorithm, Multi-Layer Perceptron
## 5 Proposed Classification Model  
This section contains an important discussion of our suggested model and the types of inputs that go into it. We combine four parameters into a mixture because no single parameter can clearly distinguish between a typical client or an assault from the dataset. These groupings are examined to determine whether a specific group value places a given IP address in the category of attacks, suspicious, or regular clients. We have grouped the four parameters according to the following values:  
1. 1 st parameter (TQ value);
2. 2 nd parameter (PKQ value);
3. 3 rd parameter (PX-IP value);
4. 4 th parameter (SourcePort value). ```
1:S-IP \(\leftarrow\) Source IP
2:ProxyIP-count \(\leftarrow\) initialize
3:if S-IP == GET_request or S-IP == POST_request then
4:Go to step 7
5:elseGo to step 1
6:endif
7:Se_Time [ ] = SourceIP_Se_Time
8:Packet_length [ ] = SourceIP_paketlength
9:if S-P == Anonymous_ProxyList-IP then
10:ProxyIP-count++
11:elseGo to step 13
12:endif if S_IP-Port==Constant then
13:SourcePort == Constant
14:elseSourcePort == Varying
15:endif
16:for i in range (0, Se_Time[ ]) do
17:for j in range (i + 1, Se_Time[ ]) do
18:if arr[i] == arr[j] then
19:No of host equal Session Time ++
20:endif
21:endif
22:endfor
23:endfor
24:for i in range (0, Time_Frame[ ]) do
25:for j in range (i + 1, Packet_length[ ]) do
26:if arr[i] == arr[j] then
27:No of host equal Packet frame Size ++
28:endif
29:if No of host equal Session Time \(\geq\) 20 then
30:TQ == High
31:elseTQ == Low
32:endif
33:if No of host equal Packet Frame size \(\geq\) 20 then
34:PKQ == High
35:elsePKQ == Low
36:endif
37:if ProxyIP-count \(\geq\) 20 then
38:PX-IP == High
39:elsePX-IP == Low
40:endif
41:endif
42:endfor
```  
**Algorithm 1** Pseudo-code for DDoS attack detection Our proposed algorithm uses high and low values for the first, second, and third parameters and varying and fixed values for the fourth parameter, as shown in Table 4. Figure 7 depicts the structure of the chosen network. The error histogram of the chosen network is shown in Figure 8.  
Figure 6: Flow chart of the proposed methodology. Figure 8: Error histogram of the chosen network. Figure 7: Structure of the chosen network. \begin{table}
\begin{tabular}{l l l l l l} \hline
**No** & **TQ** & **PKQ** & **PX-IP** & **SourcePort** & **PD** \\ \hline
1 & Low \textless{}20 & Low \textless{}20 & Low \textless{}20 & Constant \textless{}=20 & Normal \\ \hline
2 & Low & Low & Low & Varying & Suspicious \\ \hline
3 & Low & Low & High & Constant & Normal \\ \hline
4 & Low & Low & High & Varying & Suspicious \\ \hline
5 & Low & High & Low & Constant & Normal \\ \hline
6 & Low & High & Low & Varying & Suspicious \\ \hline
7 & Low & High & High & Constant & Suspicious \\ \hline
8 & Low & High & High & Varying & Attack \\ \hline
9 & High & Low & Low & Constant & Normal \\ \hline
10 & High & Low & Low & Varying & Suspicious \\ \hline
11 & High & Low & High & Constant & Suspicious \\ \hline
12 & High & Low & High & Varying & Suspicious \\ \hline
13 & High & High & Low & Constant & Attack \\ \hline
14 & High & High & Low & Varying & Attack \\ \hline
15 & High & High & High & Constant & Attack \\ \hline
16 & High & High & High & Varying & Attack \\ \hline \end{tabular}
\end{table} 
Table 4: Grouping of different parameters for DDoS attack detection criteria. Note: TQ: no. of host spent equal session time; PKQ: no. of host equal packet length; PX-IP: no. of host use proxy server; SourcePort: host changing ports; PD: pattern detection. Figure 9 shows a schematic diagram of an artificial neural network (ANN). Further study regarding different variants of neural networks can be seen in [65]. Equation (1) is used to calculate the derivative of error with respect to (w.r.t.) output weights (\(w_{jk}\)). \[\frac{\partial E}{\partial w_{jk}}=\delta_{k}a_{j} \tag{1}\]  
The following Equation (2), is used for calculation of error derivatives w.r.t. output layer biases \((b_{k})\).