# Two-Phase Deep Learning-Based EDoS Detection System
## 4 System Design
### System Workflow  
Figure 5 presents a detailed architecture of the two-phase deep learning-based EDoS detection mechanism. During the data preprocessing stage, the collector runs a Wireshark tool every 5 s to capture all packets going through a switch when installing OpenVswitch, in which the system resources of the victim server are also collected. The network packets will be captured into a pcap file and saved to a disk in the collector machine. Afterward, the feature extractor will load the pcap file from the collector to extract the data attributes. These data attributes will also be transformed and standardized to fit the ANN model. After preprocessing, the appropriate data will be sent to the first detector-ANN model to detect whether an attack happened during that 5-s time period. If the ANN model, which is a binary classifier, outputs an attack, the observed pcap file of a 5-s time period is now split into five consecutive pcap files of 1-s time periods. The feature extractor is called again to extract the flow-based attributes of each flow in the five consecutive pcap files constructed. The extracted flow-based features are constructed for sequential data having a length of five. The sequential data are sent to the flow detector, i.e., the LSTM model, to classify where each flow in the observed time period is abnormal. If a flow is detected as an abnormal flow, the source address of this flow will be updated to a blacklist of a firewall. Note that to effectively adapt our proposed framework to different network systems, the ANN and LSTM models will be replaced by new ANN and LSTM models that are trained using the updated database in a preset time. The workflow of the two-phase deep learning-based EDoS detection mechanism is summarized in Algorithm 1.  
Figure 4: Conceptual architecture of the proposed model.  
```
\(P_{i}\longleftarrow\)Pcap file of a 5-s period \(i\) \(Pe_{i}\longleftarrow\)Feature tuple of the period \(i\) \(periodOutput\longleftarrow\)Output of the ANN detector \(flowOutput\longleftarrow\)Output of the LSTM detector \(m\longleftarrow\)Number of flows in \(P_{i}\) \(x^{l}=\{x_{i-t}^{j}x_{i-3}^{j},x_{i-t}^{j},x_{t-2}^{j},x_{t-1}^{j},x_{t}^{j}\}\longleftarrow\)A sequential feature of each flow \(j\) from \(t-4\) to \(t\) \(P_{j}\longleftarrow\)Fcap file of flow j in splitted from \(P_{i}\) \(FeatureExtractor\longleftarrow\)Feature Extractor module \(ANN\longleftarrow\)ANN model \(LSTM\longleftarrow\)LSTM model \(ipAddress\longleftarrow\)Ip address of flow j loop  Every 5 sCollector captures \(Pi\)  Send \(Pi\) to \(\overline{FeatureExtractor}\longrightarrow Pe_{i}\)  Feed \(Pe_{i}\) to \(\overline{ANN}\longrightarrow periodOutput\) if\(periodOutput==1\) (attack period)then  Split \(Pi\) into \(m\)pcap files of \(m\) flows for\(j\) to \(m\)do  Send \(P_{j}\) to \(\overline{FeatureExtractor}\longrightarrow x^{j}\)  Feed \(x^{j}\) to \(\overline{LSTM}\longrightarrow flowOutput\) if\(flowOutput==1\) (abnormal flow) then  Send \(ipAddress\) to vFirewall else continue endif endfor else  continue endif endloop
```  
**Algorithm 1** The two-phase deep learning-based EDoS Defense Mechanism  
Figure 5: Detailed architecture of the proposed model.