# Detection of HTTP DDoS Attacks Using NFStream and TensorFlow
## 5 Discussion  
This section describes some insights into the experimental findings and selects some findings to illustrate the method used. The detection and machine learning performance was evaluated using various parameters and showed substantial performance compared to existing work conducted in the same field [75; 78]. The detection accuracy of the anomaly detection system depends on the correct classification of the attack and normal network traffic. The method used showed an overall classification accuracy of 96.54%. The accuracy of the model differed when measuring three experiments where different types of data were entered. The parameters of machine learning can be changed, mainly by adding the number of training epochs, which increases the accuracy. The problem to be solved during training is the identification and prevention of pre-training of the model. Such pre-training artificially increases the quality of the created model, and the model cannot continue to learn during further training. This error occurs in a large number of studies and should be avoided [94; 95]. Another parameter is the introduction of newer samples, which affect the accuracy even when detecting new types of attack. In a large number of works, the authors use publicly available datasets to create machine learning models, which do not always contain accurate information describing the attack or contain incomplete or anonymized data that then affect the accuracy of the measurements [96; 97]. In comparison to the work of other authors, which used detection tools such as netflow, which are most often implemented in routers, we decided to use the nfstream application in our work, which can be used to record network traffic on other devices as well. The differentiating factor in other research works is the possibility of implementing the resulting machine learning model into the network flow analysis process, which makes it possible to easily evaluate network traffic [98; 99]. Furthermore, it is possible to apply a granular deployment of this model, where network traffic can be effectively analyzed with the help of smaller probes [100; 101]. The price of such an analysis was addressed by authors in other works. Compared to other works, the nfstream application allows you to record parameters other than just basic netflow data [102]. Among the additional parameters, the analysis of network flows using nDPI can be included, where it is possible to detect currently used protocols and applications to categorize network traffic. Such parameters increased the accuracy of the subsequently created model [103]. \begin{table}
\begin{tabular}{l l} \hline Test1—result of Attack and good transactions & 92.85\% \\ \hline Test2—result of Attack transactions & 96.54\% \\ \hline Test3—result of good transactions & 3.05\% \\ \hline \end{tabular}
\end{table} 
Table 9: Results of the test dataset. LTSM was chosen as the machine learning model. Other machine learning models are also described in studies. We would like to emphasize the comparison between two works dealing with the detection of DDOS attacks using machine learning [104]. By implementing the LSTM-BA neural network, it is possible to achieve the desired results. However, as stated in the work \"LSTM-BA: DDoS Detection Approach Combining LSTM and Bayes\", it is possible to create a model that combines the advantages of two networks, namely LSTM RNN and Bayes network (LSTM-BA ). With this combination, the researchers were able to increase the accuracy of the model by 1.4% in DDoS detection. When compared to the model we tested, this was only a minimal increase in accuracy. In the article, \"Self-supervised network traffic management for DDoS mitigation within the ISP domain\", the authors achieved an average detection accuracy of 86% using decision tree, random forest and GBT algorithms. When comparing machine learning algorithms, such as SVC and LG from other works, the method chosen by us achieved the best results.