# Deep-Learning-Based Approach to Detect ICMPv6 Flooding DDoS Attacks on IPv6 Networks
## 5 Experimental Results
### Results and Discussion  
This phase generates three training models through RNN, LSTM, and GRU using the architectures listed in Tables 6-8, respectively. These training models are generated using \((f^{\prime})\) features. RNN-, LSTM-, and GRU-based approaches require long training and inference time; therefore, we trained the model offline to overcome the issue. Then, the generated detection model (RNN, LSTM, and GRU prediction model) was deployed and operated online to detect ICMPv6 flooding DDoS attacks. We must retrain the model if significant changes occur to the environment, such as adding new servers or services. Table 9 shows the confusion matrix of RNN, LSTM, and GRU. Based on Table 9, TNR, FNR, FPR, accuracy, and F-measure are calculated using Equations (12)-(17), respectively, as shown in Table 10.  
As shown in Table 10, RNN, LSTM, and GRU can detect ICMP6 flooding DDoS attacks using the \((f^{\prime})\) features with a detection accuracy of 92.3%, 98.41%, and 98.3%, respectively, and with FPR of 12.8%, 0.551%, and 0.884%, respectively. We can observe that LSTM outperforms RNN and GRU in the accuracy, FPR, and F-measure metrics. Meanwhile, RNN, LSTM, and GRU reported almost identical FNR results, but RNN achieved the worst FPR. Figure 4 depicts the result of recall and precision of RNN, LSTM, and GRU. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Model** & **TNR (\%)** & **FNR (\%)** & **FPR (\%)** & **Accuracy (\%)** & **F- Measure (\%)** \\ \hline RNN & 87.1 & 2.3 & 12.8 & 92.3 & 92.71 \\ LSTM & 99.4 & 2.62 & 0.551 & 98.41 & 98.39 \\ GRU & 99.11 & 2.49 & 0.884 & 98.31 & 98.29 \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Evaluation performance of RNN, LSTM, and GRU. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Layer (Type)** & **Output Shape** & **Param \#** \\ \hline gru\_3 (GRU) & (None, 32) & 3360.0 \\ dropout\_26 (Dropout) & (None, 32) & 0 \\ batch\_normalization\_13 & & \\ (Batch Normalization) & (None, 32) & 128.0 \\ dropout\_27 (Dropout) & (None, 32) & 0 \\ flatten\_13 (Flatten) & (None, 32) & 0 \\ dense\_13 (Dense) & (None, 2) & 66.0 \\ \hline Total params: 3554.0 & & \\ Trainable params: 3490.0 & & \\ Non-trainable params: 64.0 & & \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Architecture GRU. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Actual Class** & **Attack** & **Normal** \\ \hline \multicolumn{3}{c}{Confusion matrix of RNN} \\ \hline Attack & 25,668 & 619 \\ Normal & 3412 & 23,045 \\ \hline \multicolumn{3}{c}{Confusion matrix of LSTM} \\ \hline Attack & 25,598 & 689 \\ Normal & 146 & 26,311 \\ \hline \multicolumn{3}{c}{Confusion matrix of GRU} \\ \hline Attack & 25,631 & 656 \\ Normal & 234 & 26,223 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Confusion matrix of RNN, LSTM, and GRU. Figure 4 shows that LSTM outperforms RNN in terms of precision (99.43%) and performs nearly as well as GRU in precision and recall. The high precision percentage means it has a lower false positive value. Meanwhile, the high recall percentage of LSTM indicates a lower false negative value. Figure 5 depicts the AUC (area under the curve)-ROC (receiver operating characteristics) curves of RNN, LSTM, and GRU. The AUC-ROC curve is a performance metric for classification problems with varying threshold settings. AUC represents the degree or measure of separability, while ROC is a probability curve. It indicates how well the model can distinguish between classes. The greater the AUC, the better the model predicts 0 classes as 0  
Figure 4: Recall and precision of RNN, LSTM, and GRU. Figure 5: ACU–ROC curves of RNN, LSTM, and GRU. values range from 0 to 1, and the closer the AUC is to 1, the better the model is, which indicates a good measure of separability. Conversely, the closer the AUC curve is to 0, the poorer the model is. As shown in Figure 5b,c, LSTM and GRU have the same AUC value of 0.98. As the AUC value approaches 1, both classifiers excel at differentiating between normal and attack traffic, implying a high detection accuracy.