# Two-Phase Deep Learning-Based EDoS Detection System
## 2 Related Works  
Several techniques for alleviating EDoS attacks can be found in the literature. Each comes with its own benefits and limitations. Self-verifying proof of work (sPoW) [4] proposed by [PERSON] and [PERSON] acts like a DNS server but returns a crypto puzzle with an encryption key instead of the IP address. The client must solve this puzzle to receive authorization to use the cloud service. However, attackers can easily launch a puzzle accumulation attack without solving a crypto-puzzle-based request. In addition, the scheme is vulnerable to a false positive rates because some legitimate users might be denied service owing to the difficulty of the puzzle. In [5; 6], the authors proposed EDoS-Shield to lessen the impact of EDoS attacks in cloud computing. Two main components, virtual firewalls (VFs) and authentication nodes (V-nodes) have major roles in detecting EDoS attacks. The authentication nodes conduct a verification process using a graphical Turing test for requests sent from a new IP address and choose to put this address in either a whitelist or a blacklist. The subsequent requests that are from an IP address in the blacklist will be blocked by the virtual firewall. Although EDoS-Shield is quite effective at preventing botnet-generated traffic, this model uses a graphical Turing test, which is poor at verification. Such a test can lead to a high false-positive rate and increase end-to-end latency. Two other studies, also using a graphical Turing test and a crypto puzzle technique to mitigate EDoS attacks, are described in [7; 8], respectively. The limitations of these mechanisms are similar to those of EDos-Shield or sPow, i.e., a high false-positive rate and increasing end-to-end latency.  
Some statistical methods such as entropy [16] or fuzzy [17] are proposed to detect EDoS attacks. In [16], the authors achieved a good detection accuracy. However, the method was experimented on in an extremely simple testbed, which raises doubt regarding its performance in real-world performance. Fuzzy-entropy-based EDoS mitigation described in [17] produces high errors because of the predefined rule.  
Some researchers have recently proposed machine-learning-based techniques to handle EDoS attacks. In [13], an execution trace to detect different EDoS attacks is analyzed. They use an SVM and a neural network, and propose a set of features to detect three types of EDoS attacks. However, this mechanism only detects whether an attack is occurring and warns the cloud to react. If there is an attack happening, the cloud provider will not scale up the system. In addition, EDoS attacks cannot be detected on each flow. Recognizing that network traffic is a type of multivariate time-series data, the authors in [14; 15] proposed an LSTM and gated recurrent unit (GRU), two variant forms of a recurrent neural network (RNN). These algorithms can handle sequential relationship data problems extremely effectively. The mechanisms in [14; 15] achieve high accuracy and are evaluated through several metrics such as accuracy, detection time, cost, and complexity. However, using LSTM and GRU leads to a problem of high resource consumption. The sequence length of the input data required for two algorithms is long. The LSTM in [14] requires a sequence length of 250, and the GRU requires a length of 100. This lengthens the detection time and increases the resources of the defense system.  
As shown in the above review, no existing proposals have the correct approach to achieve a high accuracy, use fewer resources, and detect each flow of network traffic in EDoS attack tackling. From an analysis of the LSTM algorithm and recommendations on the defense inspired by two recently conducted in-depth studies on EDoS characteristics ([18; 19]), we propose a two-phase deep learning-based EDoS detection mechanism to take advantage of the LSTM and eliminate the limitations of the model complexity.