# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 5 Experimental Results
### Offline Train  
This section mainly introduces the offline training module, which includes CNAT model tuning, and verifies the model detection ability.  
In the offline phase, the experiment has been implemented in Python v3.7 ([[https://www.python.org/downloads/release/python-373/](https://www.python.org/downloads/release/python-373/)]([https://www.python.org/downloads/release/python-373/](https://www.python.org/downloads/release/python-373/)) (accessed on 3 December 2021)) using Keras API v2.2.4 ([[https://github.com/keras-team/keras](https://github.com/keras-team/keras)]([https://github.com/keras-team/keras](https://github.com/keras-team/keras)) (accessed on 3 December 2021)). We used TensorFlow2.1 ([[http://tensorflow.google.cn/install](http://tensorflow.google.cn/install)]([http://tensorflow.google.cn/install](http://tensorflow.google.cn/install)) ((accessed on 3 December 2021)) with GPU support enabled by cuDNN ([[https://docs.nvidia.com/deeplearning/sdk/pdf/cuDNN](https://docs.nvidia.com/deeplearning/sdk/pdf/cuDNN)]([https://docs.nvidia.com/deeplearning/sdk/pdf/cuDNN](https://docs.nvidia.com/deeplearning/sdk/pdf/cuDNN)) (accessed on 3 December 2021)) a GPU-accelerated library for deep neural networks.  
After applying the statistical detection module in Figure 1, we cleaned the abnormal dataset, including deleting outliers and so on. The abnormal dataset is composed of 84 traffic flow features with the CICFlowmeter tool. Then, we selected 29 packet payload and header effective features from the abnormal dataset in Table 4. Then, we divided them into a training set and a testing set at a ratio of 7:3. The dataset is shown in Table 5.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**No.** & **Feature Name** & **No.** & **Feature Name** \\ \hline
1 & Total Fwd Packet & 16 & Subflow Bwd Bytes \\ \hline
2 & Total Length of Fwd Packet & 17 & Total Bwd packets \\ \hline
3 & Fwd Packet Length Max & 18 & Total Length of Bwd Packet \\ \hline
4 & Fwd Packet Length Min & 19 & Bwd Packet Length Max \\ \hline
5 & Fwd Header Length & 20 & Bwd Packet Length Min \\ \hline
6 & Fwd Packet Length Mean & 21 & Bwd Header Length \\ \hline
7 & Fwd Packet Length Std & 22 & Bwd Packet Length Mean \\ \hline
8 & Fwd Segment Size Avg & 23 & Bwd Packet Length Std \\ \hline
9 & Packet Length Min & 24 & Bwd Segment Size Avg \\ \hline
10 & Packet Length Max & 25 & Packet Length Variance \\ \hline
11 & Packet Length Mean & 26 & Average Packet Size \\ \hline
12 & Packet Length Std & 27 & Fwd Segment Size Avg \\ \hline
13 & Subflow Fwd Packets & 28 & Bwd Segment Size Avg \\ \hline
14 & Fwd Seg Size Min & 29 & Subflow Bwd Packets \\ \hline
15 & Subflow Fwd Bytes & \\ \hline \hline \end{tabular}
\end{table}
Table 4: Features subset.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Type** & **Number of Abnormal Traffic Events** \\ \hline Training Set & 1,607,313 \\ Testing Set & 267,885 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Abnormal dataset.  
Optimizing the hyper-parameters is a necessary step to maximize the model accuracy and minimize the model loss. They influence the training process and the model complexity. By comparing different parameters, we can obtain the CNAT model with the best performance and save the relevant model structure and parameters. This section adjusts the three parameters described in Section 3.3, namely the batch size, optimizer, and learning rate. Based on our experiments, we choose the hyper-parameters' values based on the tuning results.