# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 1 Introduction  
5G technologies provide ubiquitous connectivity while also addressing the demands of both individual consumers and businesses; however, a tremendous surge of data makes cyber-security a pressing issue, and in order to deal with security threats, various standards organizations including 3 GPP, IEEE, and ETSI have been looking into security issues for 5G networks [1]. In 2019, the DDoS attack landscape report [2] indicated that DDoS, a common attack method, is still one of the main threats facing networks, affecting the availability and performance of network services. In 2020, the DDoS attack landscape report [3] pointed out that, with the rapid development of network devices, different varieties of low rate attacks and distributed reflection denial of service attacks are emerging. Thus, it is necessary to upgrade protection measures. An Internet network security monitoring data analysis report [4] summarized the data in terms of malicious programs, vulnerability risk, DDoS attacks, and website security. According to the results, DDoS attacks are still one of the most common malicious behaviors because of their low cost and obvious effect. By controlling multiple computers, DDoS attackers send intensive attack packets to the victim, perform specific malicious behaviors, and consume the victim's computing resources. There are various ways to form DDoS malicious behaviors. DDoS attackers control machines to build botnets to send large numbers of packets to flood victim hosts. Another possible method of attack is that an attacker will exploit the vulnerability of TCP three handshakes, UDP, or application layer protocols, leading to complex malicious behavior. The malicious behavior includes botnets, low-rate, network layers, DRDoS (distributed reflection denial of service), application layer DDoS, etc. Before launching an attack, the attacker obtains full information about the victim's application service or the network protocol vulnerabilities. According to their specific vulnerabilities, the malicious behavior is launched. This leads to an end to normal service. Furthermore, the network routers do their best to forward packets that transmit communication protocols, including legitimate and attack packets. The network is a collection of queues, and each queue has a cache area. When the malicious packets are sent constantly, packets fill up the cache area, further increasing the victim congestion and overload. This leads to reduced network performance [5]. As the attack numbers and complexity continue to grow, AI addressing security issues is a new trend; therefore, with the development of 5G networks, a necessary measure is the ability to automatically detect DDoS [6]. At present, there are two approaches used to detect DDoS, including statistical analysis and the deep neural network method [7]. By setting an appropriate threshold, statistical methods can identify attacks. [PERSON] et al. [8] proposed the BotMark method, which calculates the flow stability based on the packet length. A single feature is not sufficient to represent the entire flow behavior. The more features there are, the greater the computational load will be. Only a single feature calculates the flow stability, which can result in small computation and a low detection latency. Nevertheless, a single feature can increase false positives. [PERSON] et al. [9] proposed an EWMA (an exponentially weighted moving average mechanism) combined with Jeffrey distance to detect a variety of attacks, while not having the effect on the network. We can utilize multiple features to gain flow stability. The flow stability can fully represent the flow characteristics. The exponentially declining weighted moving average method can estimate the flow similarity value. Although the network traffic will change dynamically, we can get the flow similarity value in advance.