# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 5 Experimental Results
### Offline Train
#### 5.2.4 Comparison with Other Methods
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c} \hline \hline  & \multirow{2}{*}{**Type**} & \multicolumn{6}{c}{**LSTM + Attention(LSAT)**} & \multicolumn{6}{c}{**CNN + LSTM(CNLS)**} & \multicolumn{6}{c}{**CNAT**} \\ \cline{3-14}  & & & **Pre** & **Rec** & **MTDC** & \begin{tabular}{c} **Response** \\ **Time** \\ **(min)** \\ \end{tabular} & **Pre** & **Rec** & **MTDC** & \
\begin{tabular}{c} **Response** \\ **Time** \\ **(min)** \\ \end{tabular} & **Pre** & **Rec** & **MTDC** &
\begin{tabular}{c} **Response** \\ **Time** \\ **(min)** \\ \end{tabular} \\ \hline \multirow{3}{*}{Botnet} & Ares & 0.99 & 0.99 & \multirow{3}{*}{81} & 0.99 & 0.99 & \multirow{3}{*}{69} & 0.96 & 0.99 & \multirow{3}{*}{20} \\ \cline{2-14}  & BYOB & 0.91 & 0.68 & & & 0.85 & 0.7 & & & 0.81 & 0.97 & \multirow{3}{*}{97} \\ \cline{2-14}  & Zeus & 0.99 & 0.58 & & 0.44 & 0.09 & & & 0.91 & 0.93 & & \\ \cline{2-14}  & Mirai & 0.99 & 0.99 & & & 0.99 & & & 0.91 & 0.99 & & \\ \hline \multirow{3}{*}{Net-work} & SYN & 0.99 & 0.99 & \multirow{3}{*}{99} & \multirow{3}{*}{140} & 0.99 & 0.99 & \multirow{3}{*}{99} & 0.99 & \multirow{3}{*}{156} & 0.99 & 0.99 & \multirow{3}{*}{99} \\ \cline{2-14}  & ACK & 0.99 & 0.99 & & & 0.99 & 0.99 & & & 0.99 & 0.99 & \\ \cline{2-14}  & UDP & 0.99 & 0.99 & & & 0.99 & 0.99 & & & 0.99 & 0.99 & \\ \hline \multirow{3}{*}{LD-DoS} & Slow & \multirow{3}{*}{0.76} & Slow & \multirow{3}{*}{75} & \multirow{3}{*}{135} & 0.99 & 0.93 & \multirow{3}{*}{75} & 0.95 & 0.91 & \multirow{3}{*}{21} \\ \cline{2-14}  & Body & & & & 0.77 & 0.65 & & & & 0.8 & 0.43 & \\ \cline{2-14}  & Slow & Headers & 0.57 & 0.78 & & & 0.58 & 0.78 & & & 0.52 & 0.86 & \multirow{3}{*}{71} \\ \cline{2-14}  & Slow & Read & & & 0.99 & 0.67 & & & 0.99 & 0.66 & & \\ \hline \multirow{3}{*}{Application} & CTC & 0.56 & 0.49 & \multirow{3}{*}{58} & 0.68 & 0.46 & \multirow{3}{*}{161} & 0.62 & 0.04 & \multirow{3}{*}{46} & \multirow{3}{*}{23} \\ \cline{2-14}  & HTTP Flood & 0.79 & 0.31 & & & 0.81 & 0.97 & & & 0.92 & 0.99 & \multirow{3}{*}{18} \\ \cline{2-14}  & HTTP Get & 0.79 & 0.31 & & & 0.75 & 0.46 & & & 0.43 & 0.48 & \\ \cline{2-14}  & HTTP Post & 0.83 & 0.57 & & & 0.85 & 0.67 & & & 0.67 & 0.35 & \\ \hline \multirow{3}{*}{DR-DoS} & NTP & 0.96 & 0.99 & \multirow{3}{*}{99} & \multirow{3}{*}{113} & 0.94 & 0.99 & \multirow{3}{*}{98} & 0.99 & \multirow{3}{*}{171} & 0.96 & 0.96 & \multirow{3}{*}{97} \\ \cline{2-14}  & SNMP & 0.95 & 0.99 & & & 0.98 & & & 0.93 & 0.99 & \multirow{3}{*}{18} \\ \cline{2-14}  & SSDP & 0.97 & 0.99 & & & 0.95 & 0.99 & & & 0.96 & 0.96 & \multirow{3}{*}{18} \\ \cline{2-14}  & Chargen & 0.89 & 0.99 & & & 0.91 & 0.99 & & & 0.88 & 0.99 & \multirow{3}{*}{97} \\ \cline{2-14}  & Memached & 0.99 & 0.99 & & & 0.99 & & & 0.93 & 0.99 & & \\ \cline{2-14}  & TFTP & 0.97 & 0.99 & & & 0.95 & 0.99 & & & 0.95 & 0.94 & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Contrast detection result. 0.48. For the HTTP Post attack, the CNLS model has the best performance in terms of precision and recall. This is because HTTP Post and HTTP Get attacks both send a large number of requests packets after the TCP three-way handshake. Therefore, it takes a long time to get HTTP response packets. The two attacks types' behavior is similar. Therefore, for HTTP Post and Get attacks, the detection performance of the three models is poor. According to the above analysis, although the performance of the CNAT model is relatively poor, the CNAT response time is the shortest. Thus, considering the performance and response time, the CNAT model is the best detection model. For DRDoS attacks, all of the models show similar performance in terms of detection metrics, but CNAT has the shortest response time. Based on the above analysis, it can be concluded that the CNAT model proposed is more suitable for detecting 21 DDoS attack types including botnet, LDDoS, Network, Application, and DRDoS attack.