# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 5 Experimental Results
### Distinguishing Attack Traffic from Benign Traffic
#### 5.1.3 Comparison with Other Methods  
[PERSON] et al. [31] pointed out that KL can measure the difference between two probability distributions, so this is usually used to detect anomalies. [PERSON] et al. [32] proposed the Bhattacharyya distance which can measure the similarity of two discrete probability distributions and the authors pointed out that the Bhattacharyya distance has found several applications in classical statistics. Therefore, KL and Bhattacharyya are commonly used to measure similarity. In this article, we compare the proposed method with the KL and Bhattacharyya distance methods to verify the effectiveness of our method.  
In Figure 6a, the horizontal axis gives different similarity methods, the left vertical axis is the detection rate of different methods, and the right vertical axis is the response time. It can be seen from the figure that the similarity method proposed has the highest detection rate, which effectively measures the similarity and completely distinguishes between benign flow and abnormal flow. The KL and Bhattacharyya algorithms can achieve 0.96 and 0.90 detection rates, respectively. This indicates that the similarity between benign traffic and abnormal traffic is high, which indicates that some abnormal traffic cannot be  
Figure 5: Detection rate of the MFPK method.  
distinguished by the threshold. Finally, both the KL and Bhattacharyya algorithms can misjudge abnormal flow as benign flow.  
Figure 6a shows that the detection time of the KL algorithm is at least 135 s, the proposed method's is 164 s, and the Bhattacharyya algorithm's is 170 s. All three algorithms have a similar response time, which is related to the algorithms' complexity and the traffic flows. If the simulated attacks are high-speed attacks (such as application layer attacks and network layer attacks), the attack packets generated by these attacks are sudden. Thousands of flows may be collected within a time window of 90 s, which results in a long response time. If a low-rate attack (such as LDDoS) is simulated, the packet transmission rate is similar to that of benign traffic, so the traffic collected in the time window may number in the hundreds, resulting in a short response time. In sum, the proposed method can achieve both a high detection rate and an appropriate response time.  
In Section 3.1, we analyzed and selected features that can represent the attack behavior. To prove the effectiveness of the features selected, we compared the performance with the existing feature selection methods [33; 34].  
In Figure 6b, the horizontal axis is different feature selection methods, the left vertical axis is the detection rate of different methods, and the right vertical axis is the response time. It can be seen that the proposed feature is the highest and the response time is the shortest. Both [33; 34] used the flow duration time. In DDoS attacks, there is usually sudden traffic, which leads to an increase in the number of small packets. Therefore, the duration of each  
Figure 6: Detection rate of popular similarity methods: (**a**) Contrasting statistical methods; (**b**) contrasting feature selection methods.  
flow is short. In benign traffic, there are high bandwidth and large file transmission, which leads to a decreased flow number. Thus, the flow duration time is long [54]. Although the flow duration can distinguish between attack traffic and benign traffic, the network traffic is unstable, and the attack flow duration is not concentrated in a specific value. When calculating the similarity algorithm, it is necessary to increase the response time. Therefore, although both methods have a high detection rate, they are not suitable for online detection.  
In summary, according to our experimental comparison and analysis, the proposed method has a high detection rate and a low response time.