# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 3 Detection Model
### Two-Stage Detection Model  
The two-stage detection model for detecting DDoS attacks is illustrated in Figure 1. The figure shows the steps involved in collecting network traffic data to detect attacks. The detection method consists of a construction dataset module, a statistical model, and a neural network detection model.  
Figure 1: Two-stage DDoS detection model.  
In the construction dataset module, we build the prototype system and deploy attack tools. The traffic collection tool captures TCP/IP data packets, then extracts them into a flow feature dataset. The specific details about the dataset can be seen in Section 4.1.  
In the statistical analysis module, we built a statistical model of benign traffic based on flow features. Based on the currently observed traffic and statistical model, we utilized statistical techniques to calculate the similarity value. If the similarity exceeds a certain threshold, the currently observed traffic is abnormal. In this paper, the abnormal events are malicious attacks.  
Therefore, we regard this as a binary classification problem. In order to classify attacks and benign traffic, we select representative features by analyzing malicious behavior.  
In the botnet network, botnet hosts regularly update a library file with a server. During the update process, the packet size and length change regularly. For DRDoS, the attacker sends requests to the reflector, and the reflector sends various response packets to the victim. These response packets have the same size and length. For the application layer attack, the attackers send HTTP requests to the server over a long time to make the webserver flood; thus, the packet size and length change regularly.  
For the network layer DDoS, the attack tool can initiate flood attacks by setting the packet size and packet length. The normal user can send requests to the server and stay on the server for some time so that the user can browse the information. Usually, for benign traffic, the URLs require different packet sizes. The data packet size and length are considered traffic features that can be used to distinguish between benign traffic and attack traffic.  
For low-rate attacks, it is necessary to establish a connection between the source and the destination host, and the destination host sets a minimum window to read the bytes. The transmission rate of bytes is slowly maintained by the source host and the destination host. Many useless packets increase for a short period of time in high-rate attacks (such as network layer flood, application layer flood, and reflection amplification attacks). The benign traffic rate is different from low-rate and high-rate attacks. The growth of flow numbers is very obvious. Therefore, we consider the flow rate one of the most important features.  
In addition, in order to quickly achieve the effect of the attack, the attack tool specifies the victim port, and the port number also contains the attack information. Therefore, the 5-tuples include packet size, packet length, flow rate, source port, and destination port, which are used to represent malicious behaviors.  
The statistical detection module is used to establish the feature distribution of malicious behaviors and calculate the flow similarity in the time window. Then, by comparing it to the threshold, the statistical detection module outputs the abnormal traffic.  
The abnormal traffic is fed into the neural network detection module in Figure 1. The detection module learns the packet headers and payload features, further classifying DDoS attacks at the ingress router. Finally, the detection module can improve the malicious traffic detection capability and classify 21 DDoS types.