# An Adversarial DBN-LSTM Method for Detecting and Defending against DDoS Attacks in SDN Environments
## 4 Experimental Results and Discussion
### Experimental Results  
To accurately evaluate the performance comparison of this paper in real situations, we select CICDDoS2019. The CICDDoS 2019 dataset separates the data into two days. The first one is a training day, containing 12 types of different DDoS attacks, including DNS, MSSQL, Syn, NetBIOS, LDAP, SNMP, NTP, UDP-Lag, SSDP, WebDDoS, TFTP and UDP. The second is a testing day, containing six different types of DDoS attacks, which are Syn, UDP, NetBIOS, LDAP, UDP-Lag, and MSSQL. To make it easier for readers to understand, the above description has been added to the paper. The dataset uses CICFlowMeter to extract more than 80 features from the dataset and has a total of 50063112 records, including  
Figure 4: Accuracy of different Minibatch sizes.  
50006249 DDoS attacks and 56863 normal samples. As for the evaluating indicators, we have given these indicators in Section 4.1. They are the Accuracy, Precision, Recall, and F1 Score.  
We select four representative deep learning methods from GAN [15], CNN [22], LSTM [23], and MLP [24]. For the above paper, we reset and verified the results based on CICDDoS2019. The division of the training set and the test set is the same as that of this article. Moreover, we have not changed the relevant parameter settings. Figure 9 shows that we give comparison results based on the evaluating indicators. Additionally, we took the average of five experiments after stabilization.  
Figure 5: Convergence time in training with different learning rates in pretraining.  
Figure 6: Loss with different numbers of layers of LSTM in the training dataset.  
For Accuracy, our method reached an accuracy rate of 96.55%, which is higher than other methods. In the evaluating indicator, refs. [15; 22] obtained virtually identical results (their difference is less than 0.12%). For [23; 24], they reached 90.39% and 92.12%, respectively. For Precision, our method reached a rate of 96.44%. Ref. [22] reached a similar result (0.236% less than our method). Refs. [15; 23; 24] achieved results of 94.08%, 90.12%, and 92.12%, respectively. Like Recall, our method achieves a rate of 98.53% for the evaluating indicator. Compared with [15; 22; 23; 24], our method is 0.64%, 6.12%, 9.1%, and 13.75% higher than these methods. As the harmonic between Recall and Precision, our method reaches the best result with 97.47%. The methods of [15; 22; 23; 24] reach 95.94%, 92.81%, 89.77%, and 88.80%, respectively.  
Furthermore, we construct a testing dataset of adversarial DDoS attacks based on the testing day of CICDDoS2019 using the FGSM algorithm. We used this dataset to test whether our method can resist adversarial attacks. We compared the DBN-LSTM and LSTM models without GAN. As shown in Table 1, the accuracy of our method in identifying  
Figure 8: Accuracy of different numbers of layers of LSTM in the test dataset.  
Figure 7: Accuracy of different numbers of layers of LSTM in the training dataset.  
adversarial DDoS attacks can reach 91.23%. The DBN-LSTM and LSTM models without GAN can hardly resist adversarial DDoS attacks (less than 8%).  
As mentioned above, we reached the best outcomes on the evaluating indicators. Our proposed method can effectively detect DDoS attacks and adversarial DDoS attacks.