# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 3 Detection Model
### Statistical Detection Model  
Combining the methods from [8; 35], we propose a statistical detection algorithm to measure flow similarity based on previous knowledge, named MFPK. The MFPK algorithm steps are as follows:  
(1) Collect flow \(X\) and \(Y\)  
The traffic sampled aggregates to flows in the time interval \(\Delta\)T in Figure 1. \(n(0\leq n\leq K)\) are feature numbers. After the malicious behavior analysis, we adopt the five features including package size, package length, flow rate, source port, and destination port. We adopt \(K=5\). Thus, the \(X\) and \(Y\) flow consist of five features, respectively. (2) Compute flow \(X\) and \(Y\) similarity The network traffic will change dynamically, which causes the flow similarity to fluctuate. We used the exponentially declining weighted moving average method to estimate the flow similarity value. This method takes into account previous data, which makes the method sensitive to traffic changes. This method can make it easier to detect attack traffic in advance. \(P\) and \(U\) are the discrete probability distribution in the time interval \(\Delta\)T. \(P\) and \(U\) are defined as follows:  
\[P=(p_{1},p_{2},\ldots,p_{n})(0\leq n\leq K) \tag{1}\]  
\[U=(u_{1},u_{2},\ldots,u_{n})(0\leq n\leq K) \tag{2}\]  
The \(P\) and \(U\) probability distribution are as follows:  
\[P=(p_{1},p_{2},\ldots,p_{n})=\frac{X[a_{m}^{n}]}{M}=\left\{\frac{x[a_{m}^{1}] }{M},\frac{x[a_{m}^{2}]}{M},\frac{x[a_{m}^{n}]}{M}\ldots,\frac{x[a_{m}^{K}]}{ M}\right\} \tag{3}\]  
\[U=(u_{1},u_{2},\ldots,u_{n})=\frac{Y[b_{l}^{n}]}{L}=\left\{\frac{y[b_{l}^{1}] }{L},\frac{y[b_{l}^{2}]}{L},\frac{y[b_{l}^{n}]}{L}\ldots,\frac{y[b_{l}^{K}]}{ L}\right\} \tag{4}\]  
In Equations (3) and (4), the notation of flow \(X\) is \(X[a_{m}^{n}]\) and the notation of flow \(Y\) is \(Y[b_{l}^{n}]\). \(M\) and \(L\) are the total number of flows in the time interval \(\Delta\)T. \(a_{m}^{n}\) is the \(n\)-th feature value in the \(m\)-th flow. \(b_{l}^{n}\) is the \(n\)-th feature value in the \(l\)-th flow. \(x[a_{m}^{n}]\) and \(y[b_{l}^{n}]\), respectively, are the same \(n\)-th features value number. Given the positive value of the probability, we have the following relationship:  
\[p_{n}\gg 0,u_{n}\gg 0 \tag{5}\]  
\[\sum_{n}^{K}p_{n}=1,\sum_{n}^{K}u_{n}=1 \tag{6}\]  
The similarity between \(P\) and \(U\) is given by:  
\[S(p_{n},u_{n})=\sum_{n=1}^{K}\left(\frac{|p_{n}-u_{n}|}{1+\max\{p_{n},u_{n}\}}\right) \tag{7}\]  
\[E_{t}=(1-\alpha)S_{t-1}+\alpha S_{t} \tag{8}\]  
In Equation (8), \(t\) denotes the current time window, \(S_{t}\) denotes average similarity in the current time window, \(S_{t-1}\) denotes average similarity in the last time window, and \(E_{t}\) denotes the estimated similarity value in the current time window. \(\alpha\) is an adjustable parameter [43]. In general, \(\alpha\) is 0.8. In Section 5.1, we use distance to measure the traffic similarity. The distance and similarity are inversely proportional. The smaller the distance, the higher the similarity, and the larger the distance, the lower the similarity. If the probability distributions \(P\) and \(U\) are equal, the flow distance value is small. When the two probability distributions are completely different, the flow distance value will be higher. The greater the difference between the two distributions, the smaller the distance value. When the flow distance value decreases, it indicates that there may be abnormal flow in the network. In general, the normal host can always keep communicating. Thus, the normal flow has a high distance value. When an abnormal event occurs, a large number of packets exist in the network, which can decrease the distance values. The larger the distance, the less similarity between benign and attack traffic. This property can distinguish benign traffic from attack traffic according to the flow similarity. (3) Define whether abnormal traffic exists  
When we consider the network traffic dynamic, the similarity may be subject to fluctuations [44].