# A DNN Architecture Generation Method for DDoS Detection via Genetic Algorithm
## 5 Discussion  
This paper selected the models within the top 20% in terms of fitness and analyzed their architecture. Table 15 shows that the Full Connected Layer and the Softplus activation function appear most frequently, followed by the Residual Layer and finally the Maxpool2d and Relu activation function. This shows that compared with other activation functions, choosing to use the Softplus activation function can provide a better nonlinear fitting ability \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Techniques** & **ACC** & **PRE** & **REC** & **F1\_SCORET (ms)** & **KS** \\ \hline Best model generated with six datasets & 0.9902 & 0.9903 & **0.9903** & 0.9902 & 0.001477 & 0.607 \\ Best model generated with one dataset & **0.9937** & **0.9993** & 0.9881 & **0.9937** & **0.001340** & **0.624** \\ Best model generated by [PERSON] et al. [27] & 0.9777 & 0.9785 & 0.9778 & 0.9777 & 0.001371 & 0.605 \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Performce of best model generated of different methods. \begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**Techniques** & **Dataset** & **ACC** & **PRE** & **REC** & **F1\_SCORE** \\ \hline Best model generated with six datasets & CICDDoS2019 & 0.9902 & 0.9903 & **0.9903** & 0.9902 \\  & CICIDS2017 & **0.9660** & **0.9664** & **0.9660** & **0.9660** \\  & CICIDS2018 & **0.9984** & **0.9984** & **0.9984** & **0.9984** \\  & KDD\_CUP99 & **1.0000** & **1.0000** & **1.0000** & **1.0000** \\  & NSL-KDD & **0.9352** & **0.9354** & **0.9352** & **0.9352** \\  & UNSW & **1.0000** & **1.0000** & **1.0000** & **1.0000** \\ \hline Best model generated with one dataset & CICDDoS2019 & **0.9937** & **0.9993** & 0.9881 & **0.9937** \\  & CICIDS2017 & 0.7460 & 0.7500 & 0.7458 & 0.7449 \\  & CICIDS2018 & 0.5029 & 0.7514 & 0.5000 & 0.3346 \\  & KDD\_CUP99 & 0.9079 & 0.9225 & 0.9076 & 0.9071 \\  & NSL-KDD & 0.7675 & 0.7795 & 0.7663 & 0.7644 \\  & UNSW & 0.4817 & 0.4649 & 0.4835 & 0.4039 \\ \hline Best model generated by [PERSON] et al. [27] & CICDDoS2019 & 0.9777 & 0.9785 & 0.9778 & 0.9777 \\  & CICIDS2017 & 0.8121 & 0.8202 & 0.8117 & 0.8108 \\  & CICID2018 & 0.6591 & 0.6879 & 0.6583 & 0.6448 \\  & KDD\_CUP99 & 0.9995 & 0.9995 & 0.9995 & 0.9995 \\  & NSL-KDD & 0.7010 & 0.7018 & 0.7012 & 0.7010 \\  & UNSW & 0.4937 & 0.4968 & 0.4999 & 0.3308 \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Performance of models generated by different generation methods under different datasets. to a DNN in data analysis. The wide use of the Residual Layer means that the dataset selected makes the general model converge faster, while the Residual Layer allows the model to have more choices and evolve in a better direction. Table 16 shows that this paper has limited the depth of the model. Most of the same topology layers in the model only appear 1-2 times, which indicates that too many repeated topology layers may not improve the model performance, but may increase the model's running cost. Through the fitness function set in this paper, the GA adjusts the model architecture well, making the model better adapted to the dataset selected. The innovation in this paper reflects the potential of the GA in model generation. This paper proposes a DNN generation method based on a GA. The method is aimed at generating a DDoS detection model, which classifies input traffic into normal traffic and DDoS traffic. This generation method generated models through population iteration. Compared with existing models, the models generated achieved better results in accuracy, precision, recall and F1-score. This paper also generated models on multiple datasets, and the best model selected also showed better performance. Therefore, the method can generate a model with better performance in a limited time under the condition of changeable DDoS attacks. The results of this paper can provide certain reference significance for researchers, minimize the consumption of resources, realize the automation of model construction and facilitate the related work of DDoS detection to a certain extent.