# Integration of Machine Learning-Based Attack Detectors into Defensive Exercises of a 5G Cyber Range
## 9 Exercises
### DoH Flooding Attack Detection Scenario
#### 9.2.3 Application and Integration of Machine Learning for DoH Flooding Attack Detection  
The preprocessing of the data for the DoH scenario was very similar to the one in the cryptomining scenario described in Section 9.1.2. One of the main differences was the tagging of the traffic connections included in the dataset, which now need to be separated into the following classes: 0 (Normal traffic), 1 (Standard DNS over HTTPS traffic), and 2 (DoH flooding attack traffic). For the training of this model, we decided to explore the first 37 features that Tstat statistics provide. In contrast with the cryptomining exercise, in this exercise, we selected a larger number of features to warn the trainee that different feature selection strategies can be applied to ML models. After eliminating the four features containing information about the ports and IPs, which cannot be used as training data as they were used to label the traffic connections, and two features that contained timestamps and that did not only offer any additional information but biased our results, we used the remaining 31 features for the training of our models. We list these features in Table 4. Note that some features are sometimes separated into Client to Server (CS) and Server to Client (SC) communication. These features appear in the table with different CS and SC identifiers. \begin{table}
\begin{tabular}{c c l l l} \hline \hline
**CS** & **SC** & **Name** & **Metric** & **Description** \\ \hline
3 & 17 & packets & - & Total number of packets observed from the client/server \\ \hline
4 & 18 & RST sent & 0/1 & 0 = no RST segment has been sent by the client/server \\ \hline
5 & 19 & ACK sent & - & Number of segments with the ACK field set to 1 \\ \hline
6 & 20 & PURE ACK sent & - & Number of segments with ACK field set to 1 and no data \\ \hline
7 & 21 & unique bytes & bytes & Number of bytes sent in the payload \\ \hline
8 & 22 & data pkts & - & Number of segments with payload \\ \hline
9 & 23 & data bytes & bytes & Number of bytes transmitted in the payload, including retransmissions \\ \hline
10 & 24 & rexmit pkts & - & Number of retransmitted segments \\ \hline
11 & 25 & rexmit bytes & bytes & Number of retransmitted bytes \\ \hline
12 & 26 & out seq pkts & - & Number of segments observed out of sequence \\ \hline
13 & 27 & SYN count & - & Number of SYN segments observed (including rtx) \\ \hline
14 & 28 & FIN count & - & Number of FIN segments observed (including rtx) \\ \hline
31 & Completion time & ms & Flow duration since first packet to last packet \\ \hline
32 & C first payload & ms & Client first segment with payload since the first flow segment \\ \hline
33 & S first payload & ms & Server first segment with payload since the first flow segment \\ \hline
34 & C last payload & ms & Client last segment with payload since the first flow segment \\ \hline
35 & S last payload & ms & Server last segment with payload since the first flow segment \\ \hline
36 & C first ack & - & Client first ACK segment (without SYN) since the first flow segment \\ \hline
37 & S first ack & - & Server first ACK segment (without SYN) since the first flow segment \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Tstat selected features for DoH flooding attack detection. In the same way as the previous exercise, we decided to create three different models with varying levels of precision, which could teach the blue team that ML-based tools are not fool-proof and can sometimes offer wrong results if trained incorrectly, regardless of the problem being resolved. The hyperparameters with which we decided to experiment were also the number of estimators and the maximum depth, which are both explained in Section 9.1.2. However, a key difference in this exercise is that the third model, named 'doh_rf_31_c.pkl', was trained, including only normal traffic, to force it to always predict all traffic as belonging to that particular class.