# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 4 Methodology
### Dataset
According to the commands of the control command server, the zombie host will execute malicious behaviors, including Ares ([[https://github.com/sweetsoftware/Ares](https://github.com/sweetsoftware/Ares)]([https://github.com/sweetsoftware/Ares](https://github.com/sweetsoftware/Ares)) (accessed on 5 February 2021)), BYOB ([[https://github.com/malwaredllc/byob](https://github.com/malwaredllc/byob)]([https://github.com/malwaredllc/byob](https://github.com/malwaredllc/byob)) (accessed on 10 February 2021)) Zeus ([[https://github.com/Visgean/Zeus](https://github.com/Visgean/Zeus)]([https://github.com/Visgean/Zeus](https://github.com/Visgean/Zeus)) (accessed on 20 February 2021)), and Mirai ([[https://github.com/jgamblin/Mirai-Source-Code](https://github.com/jgamblin/Mirai-Source-Code)]([https://github.com/jgamblin/Mirai-Source-Code](https://github.com/jgamblin/Mirai-Source-Code)) (accessed on 7 April 2021)). Figure 3: Network topology diagram. Network layer DDoS: We used three attack hosts in the network layer attack domain. With the hping tool ([[https://github.com/antirez/hping](https://github.com/antirez/hping)]([https://github.com/antirez/hping](https://github.com/antirez/hping)) (accessed on 13 March 2021)), a large number of data packets were sent to the host in the target domain. The network layer attacks included SYN, ACK, and UDP. Benign traffic: We use the socket package ([[https://docs.python.org/3/library/socket.html](https://docs.python.org/3/library/socket.html)]([https://docs.python.org/3/library/socket.html](https://docs.python.org/3/library/socket.html)) (accessed on 15 April 2021)) to establish a connection between the client and the server to send packets. According to [47], the virtual machines simulated the 5G environment, including public services, smart homes, PC Internet, and MTC communication. This scenario generated normal communication traffic. In addition, to enrich the normal traffic category, we adopted the benign traffic in the CICIDS2017 dataset [48] as the background traffic, which can add to the traffic complexity. At the ingress router, we used the Tcpdump ([[https://www.tcpdump.org](https://www.tcpdump.org)]([https://www.tcpdump.org](https://www.tcpdump.org)) (accessed on 18 April 2021)) tool to capture the network traffic to be detected within a certain period of time. This obtained the original dataset, containing attack traffic and benign traffic. The investigation showed that different flow features are helpful for traffic analysis, which can provide relevant communication information [49]. Several approaches utilize these features to improve the abnormal detection performance [50; 51]. The information of IP flow is more comprehensive; thus, we used the CICFlowmeter tool [52] to generate flow features from the PCAP file. A network flow consists of all packets sharing a common combination of source IP, destination IP, port, and transport protocol. We extracted the network traffic with the CICFlowmeter tool, which is composed of 84 traffic flow features. The main features are the forward and backward data packet number, the data packet arrival time, the length of the data packet, the header flag count and header feature, and their statistical features, such as the minimum, maximum, average, and standard deviation. For a complete description, readers are referred to the CICFlowmeter document [52]. Our self-generated dataset contains multiple attacks and benign traffic, which are suitable for processing a large volume of traffic with neural networks. Based on the above implementation methods, Table 2 summarizes the initiation time of attack traffic and benign traffic, as well as the source and destination IP addresses. According to the timetable, we launched different types of attacks, including botnet, low-rate, network layer, application layer DDoS attacks, and DRDoS attacks.