# A DNN Architecture Generation Method for DDoS Detection via Genetic Algorithm
## 2 Previous Works  
This section will introduce some existing methods of applying the GA to model optimization. Most of these use the GA to select data features or optimize a model's hyperparameters. [PERSON] et al. used M-DBNN to detect DDoS attacks and to continuously adjust the model's weights through the chimpanzee optimization algorithm. The loss between the output of the model and the tag as the fitness was used to evaluate the weight selection method. After the evaluation of the model's weight selection method, there is a 50% probability of updating the currently selected weights and a 50% probability of randomly selecting another group of weights. After several rounds of experiments, the accuracy of the model reached 87% [23]. [PERSON] et al. believe that selecting model hyperparameters is highly resource-intensive. The model may fall into a locally optimal solution when trained under the set hyperparameters. Because of the different performances of individuals within the population, the GA can make more choices for the model. Through continuous iteration, the individuals within the population can gradually tend to the optimal solution. The author uses GA to adjust the data division method and the depth of the decision tree. The author uses accuracy as a measure of fitness to evaluate the model's performance. After multiple iterations, the model's accuracy reached 99.46% [25]. [PERSON] et al. believe that selecting data features significantly impacts the model's performance. The authors argue that the feature selection method is conducive to reducing the impact of the dimension curse, enhancing the model's generalization ability, accelerating the model's learning process and improving the model's interpretability. Before that, some researchers selected data features through information gain sorting and PCA. Still, the authors believe both these methods have limitations and that the GA is better qualified for this job. The authors use binary coding to represent the selected features, update the feature selection method with the GA and finally use the selected features to train and test the model. The experimental results on the KDD CUP99 dataset show that GA performs well in data feature selection [24]. [PERSON] et al. used GAs to select the features of the KDDCUP99 dataset. A binary string represented the feature selection method, and the accuracy was used as the fitness measure to evaluate the selected features. The authors compare the DNN and other models trained with all features with the DNN and others selected with the GA as input. The experimental results on DDoS detection show that the model trained with the features selected by the GA is superior to the model trained with all features regarding accuracy, precision and recall [26]. [PERSON] et al. adjusted the number of hidden layers, the number of hidden layer neurons, the learning rate and the epoch of the DNN training through grid search and random search and evaluated the quality of the selected relevant hyperparameters on the NSL-KDD and CICIDS2018 datasets. Because the search space selected by the author is too large, HPO was used to select excellent hyperparameters automatically. Through the experiment, the author found that the second and third hidden layers play a crucial role in the performance of the model, the epoch has almost no effect on the performance of the model and the lower the learning rate, the better the performance of the model, but the longer the training time of the model [30]. [PERSON] et al. use an optimized GA to automatically select the data processing mode and a DNN architecture for cloud network intrusion detection. The authors believe that the main factors affecting the results are the data normalization method, the activation function in the DNN, the number of hidden layers in the DNN, the learning rate and the momentum term.