# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 4 Methodology
### Evaluation Metric  
The statistical analysis detection method distinguishes attack traffic from benign traffic. We utilized the detection rate to evaluate the detection performance, and used the response time to evaluate the detection period of the statistical algorithm proposed in Section 3.2.  
\[D\text{etectionRate}=\frac{D\text{etectAbnormalTrafficNumber}}{T\text{otalTrafficNumber}} \tag{14}\]  
In Equation (14), the numerator is the incoming traffic that is classified as abnormal traffic through the MFPK algorithm, and the denominator is the incoming traffic.  
In order to measure the neural network detection performance, we provide the following performance metrics: response time, accuracy, precision, recall, confusion matrix, and loss. The model output was used to indicate the fine-grained category of DDoS attacks.  
We utilized a Python script to save on the response time. The response time reflects the model's complexity. The more complex the model, the longer the response time.  
We base our definition of accuracy, precision, and recall on the following four previous definitions: (1) false positive (FP) is the number of benign samples that are misclassified as attack traffic; (2) false negative (FN) is the number of attack samples that are misclassified as benign traffic; (3) true positive (TP) is the number of attack samples that are correctly classified as attack traffic; and (4) true negative (TN) is the number of benign samples that are correctly classified as benign traffic [53].  
Considering these previous definitions, accuracy (\(A\text{cc}\)) refers to the proportion of samples correctly classified in the total.  
\[A\text{cc}=\frac{TP+TN}{TP+TN+FP+FN} \tag{15}\]  
Precision (Pre) indicates the proportion of correctly predicted attack traffic to the predicted attack traffic.  
\[P\text{re}=\frac{TP}{TP+FN} \tag{16}\]  
Recall (Rec) indicates the proportion of correctly predicted attack traffic to all attack traffic samples.  
\[Rec=\frac{FN}{TP+FN} \tag{17}\]  
The normalized confusion matrix is mainly used to analyze the classification results of the detection model and the matching degree between prediction type and actual type.  
The loss function is used to evaluate the difference between a single traffic prediction type and the real type. The smaller the loss function, the better the robustness of the detection model. The loss function is mainly in the model training stage. After the batch size data are fed into the model, the forward propagation output is the predicted value, then, the loss function calculates the loss value. According to the loss value, the model updates each parameter to reduce the loss through back propagation, and to make the predicted value generate closer to the real value and achieve the learning purpose. Therefore, the purpose of the loss function is to reduce the loss of each iteration. This is a multi-classification problem, and we use the sparse categorical cross-entropy loss function as our loss function:  
\[\psi=-\frac{1}{N}\sum_{\text{m}\in M}\sum_{\text{s}\in\text{S}}1_{\text{m}\in M }\log\text{p}(\text{m}\in\text{s}) \tag{18}\]  
where \(\psi\) is the sparse categorical cross-entropy loss function, m is the sample number, and s is the class label.  
In addition, in order to analyze the online detection ability, we defined a new evaluation metric: malicious traffic detection capability. Malicious traffic detection capability(MTDC) means the ability to detect attack traffic after online detection. The equation is as follows:  
\[\text{MTDC}=\frac{1}{\sum\limits_{i=1}^{k}T_{i}/\sum\limits_{i=1}^{k}A_{i}} \tag{19}\]  
where MTDC is the malicious traffic detection capability, \(A_{i}\) represents the total traffic of attack traffic type i, k indicates the type of attack traffic, and \(T_{i}\) indicates the traffic correctly detected as attack traffic type \(i\).