# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 5 Experimental Results
### Distinguishing Attack Traffic from Benign Traffic
#### 5.1.1 Similarity vs. Time Window  
The reason for using distance to represent similarity has been explained in Section 3.2. As shown in Figure 4, the \(y\)-axis represents the difference of the distance values, and the \(x\)-axis represents the time window used for computing the distance values. In the case of attack traffic, the attackers generate small packets in a short period of time, and the attack traffic is more similar to legitimate traffic. This causes significant deviation from the legitimate traffic. In different time windows, the similarity of benign traffic is lower than that of attack traffic. Benign traffic is composed of 5G legal requests and human interaction behaviors. We simulated different 5G application scenarios (such as smart home, public service, and MTC communication). The request packet size and request period are different in each scenario. In the CICIDS dataset, benign traffic is generated by human interaction (e.g., HTTP, HTTPS, SSH, or email). To access the website, the user sends a normal request. During the request generation process, a data packet is randomly generated. When a network resource is requested, the user will stay on the website for a period of time, and the user can browse the web. Thus, the number of the flow is small in the process of requesting resources. Combining both situations, the data packets are random, large packets are transmitted, and the payload of the packets is various in the normal flow, so the similarity of the normal flow is low. In Figure 4, the attack traffic distance is generally smaller than the benign traffic, so the attack traffic similarity is high. The distance of benign traffic increases slowly from 30 s to 60 s. The user starts to send different request packets to the server, causing the distance value to increase, as well as the similarity to become smaller. From 60 s to 90 s, the user establishes a connection with the server for a certain period of time, and the user stably sends the same packet size to the server to transfer files. Therefore, the benign traffic distance value decreases, and the similarity is greater. When the user requests resources, the user will stay on the website for a period of time to browse the website resources. At this time, there are fewer packets in the network, so the distance value increases from 90 s to 150 s. From 150 s to 180 s, when the user finishes browsing the website, the user will request that the server close the connection, and the server will send response packets to the client. Therefore, the benign traffic distance value drops, and the similarity becomes greater. For the botnet, the botnet hosts need to inquire about the server status within a certain period of time. Then, the botnet hosts download the corresponding binary configuration file, so as to that maintain the communication between the server and the botnet; however, there are few packets in the communication traffic. Thus, the botnet traffic changes are stable and the similarity changes smoothly under different time windows. For the LDDoS, the attackers send a burst to the victim host. As time goes on, there are incomplete or short packets in the network, which leads to the distance increasing and then gradually stabilizing. However, there are fluctuations in the network traffic, which means that the LDDoS distance value will be affected by the network conditions. For application layer attacks, the application attackers send frequency HTTP requests to the server, which will affect the attack packets similarity. From 60 s to 90 s, the reason for the distance decrease is that the attacker sends a few HTTP request packets. From 90 s to 150 s, although the attacker continues to send HTTP request packets to the server, the network traffic fluctuation will cause noise, and the noise will affect the similarity. Thus, the distance value will increase during this period, and the similarity will decrease. Both network layer and application layer attacks are flood attacks.