# A DNN Architecture Generation Method for DDoS Detection via Genetic Algorithm
###### Abstract  
Nowdays, DNNs (Deep Neural Networks) are widely used in the field of DDoS attack detection. However, designing a good DNN architecture relies on the designer's experience and requires considerable work. In this paper, a GA (genetic algorithm) is used to automatically generate the DNN architecture for DDoS detection to minimize human intervention in the design process. Furthermore, given the complexity of contemporary networks and the diversity of DDoS attacks, the objective of this paper is to generate a DNN model that boasts superior performance, real-time capability, and generalization ability to tackle intricate network scenarios. This paper presents a fitness function that guarantees the best model generated possesses a specific level of real-time capability. Additionally, the proposed method employs multiple datasets to joint models generated, thereby enhancing the model's generalization performance. This paper conducts several experiments to validate the viability of the proposed method. Firstly, the best model generated with one dataset is compared with existing DNN models on the CICDDoS2019 dataset. The experimental results indicate that the model generated with one dataset has higher precision and F1-score than the existing DNN models. Secondly, model generation experiments are conducted on the CICIDS2017 and CICIDS2018 datasets, and the best model generated still performs well. Finally, this paper conducts comparative experiments on multiple datasets using the best model generated with six datasets and the best model generated by existing methods. The experimental results demonstrate that the best model generated with six datasets has better generalization ability and real-time capability. DDoS attack detection; deep neural network; genetic algorithm; model architecture generation +
Footnote †: journal:  
needs experienced researchers. Frequent model construcution will consume many resources [21]. In certain scenarios where resources and researchers are scarce, there is a need for a method to automatically generate DDoS detection models to minimize the cost of model construction. Therefore, this paper proposes a DNN model generation method based on GA, which automatically adapts to different scenarios, minimizes human intervention during the model generation process and the method generation model has a certain degree of generalization, making it a better choice for the current diverse network environment to defend DDoS attacks. Compared with the previous research, using GA to adjust the network hyperparameters [22; 23; 24; 25; 26], this paper pays more attention to the architecture of the DNN model and proposes a DNN model architecture generation method based on a GA. Although some existing methods use GAs to adjust the DNN structure to optimize the performance of the model in DDoS detection, these existing methods fix the number of layers of the DNN model and only use the full connection layer to build the DNN model, so the search space of the GA is small. In the model evaluation stage, the number of DNN model training rounds is not dynamically adjusted, and the resource consumption is large. In terms of the fitness function, only the DDoS detection rate of the DNN model is considered, and the model's running time is not considered. In terms of generalization, previous methods only used one data set to generate the model. The generated DNN model does not have a generalization and is prone to over-fitting problems [27]. The methods proposed in this paper solve these problems. Firstly, this paper expands the search space of the GA, and the generated DNN model can cope with more DDoS attack scenarios. Secondly, this paper dynamically adjusts the number of model training rounds in the model evaluation stage to reduce resource consumption. Thirdly, the fitness function designed in this paper is to take into account the running time of the model and, to some extent, ensure the ability of the DNN model to detect DDoS in real time [28].