# MOCA: A Network Intrusion Monitoring and Classification System
## 6 Conclusions  
In this paper, we designed a two-stage monitoring and classification system. Our measurements confirm that MOCA significantly outperforms previous methods. MOCA can distinguish DDoS and Bot attacks from normal and IoT traffic with high accuracy using a pre-trained model. After pre-training by the CICIDS2017 dataset, MOCA could distinguish DDoS attacks from normal traffic in the CICDDoS2019 dataset with an accuracy of 96% and DDoS attacks in non-IoT and IoT traffic with an accuracy of 99.94%. Our work shows that connection features are valuable for detecting new DDoS and Bot attacks, especially when training datasets are unavailable. They are efficient features for minimizing the training and execution time of MOCA.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset** & **Accuracy** & **Class** & **Precision** & **Recall** & **F1** \\ \hline \multirow{2}{*}{ToN-IoT [29]} & \multirow{2}{*}{0.8804} & Benign & 0.97 & 0.69 & 0.80 \\  & & Attack & 0.85 & 0.99 & 0.91 \\ \hline \multirow{2}{*}{BoT-IoT [12]} & \multirow{2}{*}{0.9994} & Benign & 0.97 & 0.96 & 0.96 \\  & & Attack & **1.00** & **1.00** & **1.00** \\ \hline \multirow{2}{*}{CICIDS2018 [7]} & \multirow{2}{*}{0.9482} & Benign & 0.90 & **1.00** & 0.95 \\  & & Attack & **1.00** & 0.90 & 0.95 \\ \hline \multirow{2}{*}{CICDDOS2019 [9]} & \multirow{2}{*}{0.9667} & Benign & 0.99 & 0.70 & 0.82 \\  & & Attack & 0.96 & **1.00** & 0.98 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Performance of binary classifiers trained by CICIDS2017 dataset and tested on four other datasets.  
\begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Class** & **MOCA Method** & **SGM [30]** & **UDBB [31]** & **WiSARD [32]** & **LSTM [33]** \\ \hline Benign & **1.00** & **1.00** & **1.00** & 0.97 & 0.87 \\ Bot & **1.00** & **1.00** & **1.00** & 0.14 & 0.83 \\ DDoS & **1.00** & **1.00** & **1.00** & 0.54 & 0.71 \\ DoS GoldenEye & **1.00** & **1.00** & **1.00** & 0.48 & 0.74 \\ DoS Hulk & **1.00** & **1.00** & 0.99 & 0.67 & 0.74 \\ DoS Slowhttptest & **1.00** & **1.00** & 0.99 & 0.23 & 0.71 \\ DoS slowloris & **1.00** & **1.00** & 0.99 & 0.79 & 0.71 \\ FTP-Patator & **1.00** & **1.00** & **1.00** & 0.00 & 0.91 \\ Heartbleed & **1.00** & **1.00** & **1.00** & 0.80 & 0.96 \\ Infiltration & **1.00** & **1.00** & **1.00** & 0.50 & 0.95 \\ PortScan & **1.00** & **1.00** & **1.00** & 0.51 & 0.98 \\ SSH-Patator & **1.00** & **1.00** & **1.00** & 0.00 & 0.87 \\ Web Attack & 0.97 & 0.96 & 0.94 & 0.47 & 0.71 \\ Brute Force & & & & & \\ Web Attack & **1.00** & **1.00** & **1.00** & 0.00 & 0.71 \\ Sql Injection & & & & & \\ Web Attack XSS & 0.92 & 0.93 & 0.88 & 0.12 & 0.71 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Performance comparison of our method vs. previous works based on CICIDS2017 dataset.  
**Author Contributions:** Conceptualization, F.W. and Y.T.; methodology, F.W., Y.T., J.F.; development; F.W., Y.T., J.F. software, F.W., Y.T., J.F.; validation, F.W., Y.T., J.F.; formal analysis, F.W., Y.T., J.F.; investigation, F.W., Y.T., J.F.; resources, F.W., Y.T., J.F.; data curation, F.W., Y.T., J.F.; writing--original draft preparation, F.W.; writing--review and editing, F.W., Y.T., J.F.; visualization, F.W., Y.T., J.F.; supervision, F.W.; project administration, F.W. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This research received no external funding.  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** Not applicable.  
**Conflicts of Interest:** The authors declare no conflict of interest.