## 6 Conclusions and Future Work  
In this work, a preprocessing stage and multiclass classification neural network model are presented. During the preprocessing stage, various transformation techniques were applied to the dataset. This improved the accuracy metrics and training time of the proposed model.  
Different datasets were evaluated for model training, and it was decided to conduct this work with the dataset provided by researchers from the CIC. During the proposed preprocessing stage, it was possible to perform a cleaning of NaN-type and null values. Similarly, a data normalization and quantile transformation were performed on the dataset. To obtain a balanced dataset in the context of classes, the SMOTE technique was applied only to the sample used for model training.  
The model was tuned based on a hyperparameter configuration. From the results of model training and validation, the tuning was applied mainly to the number of hidden layers, the rate used in the Dropout layer, and the learning rate. The model was trained and evaluated in three different scenarios. The results, metrics, and confusion matrix were presented for each scenario.  
The results show the third scenario as the best. This analysis was based on the performance metrics of the scenarios and number of labels used in the training phase. Scenario 2 yielded a 94.57% accuracy, greater than Scenario 3 by 0.31%. However, it was not trained with the 13 labels available in the dataset, unlike the third scenario, which was trained with all labels. The added value of the proposed model consists in identifying the type of attack evidenced in a flow, as compared with the binary classification of recent works.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Author [Reference]** & **Approach** &
\begin{tabular}{c} **Average** \\ **(Precision, Recall, F1 Score)** \\ \end{tabular} \\ \hline [PERSON] et al. [36] & 82 features + FS & 91.16, 79.41, 79.43 \\ [PERSON] et al. [37] \({}^{\star}\) & DNN & 70.00 \\  & RNN & 70.00 \\  & CNN & 66.46 \\ [PERSON] et al. [9] & Naive Bayes & 30.30, 17.51, 7.35 \\  & SVM & 62.44, 57.97, 55.50 \\  & Decision Tree & 61.15, 58.32, 55.15 \\  & Random Forest & 50.76, 36.91, 39.57 \\ Our approach & DNN & 94.21, 94.03, 94.12 \\ \hline \hline \end{tabular} \({}^{\star}\)No distinction for the metrics is stated by the author.  
\end{table}
Table 9: Result comparison with related works.  
As future work, we propose to deploy and evaluate the model in a computer network that has a flow not previously seen by the model. This deployment will consist of a model evaluation phase. Depending on the results, we propose to conduct a model training phase with the captured data. Once the model has been trained and validated, it could be instantiated as a network traffic manager whose objective is to reject or accept network flows based on the evaluation performed. Furthermore, this could be deployed in an intrusion-tolerant-system in order to prevent denial of service attacks, as proposed by [PERSON] et al. (2018).  
Conceptualization, A.C. and J.M.; methodology, A.C. and J.M.; software, A.C.; validation, A.C. and J.M.; formal analysis, A.C.; investigation, A.C.; resources, A.C.; data curation, A.C.; writing--original draft preparation, A.C. and J.M.; writing--review and editing, J.M.; visualization, A.C. and J.M.; supervision, J.M.; project administration, J.M. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.  
The data used in this study are openly available in Canadian Institute for Cybersecurity at [[https://www.umb.ca/cic/datasets/ddos-2019.html](https://www.umb.ca/cic/datasets/ddos-2019.html)]([https://www.umb.ca/cic/datasets/ddos-2019.html](https://www.umb.ca/cic/datasets/ddos-2019.html)) (accessed on 12 January 2021).  
Our highest recognition for the Systems Engineering department of the Universidad del Norte.  
The authors declare no conflict of interest.