# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 5 Experimental Results
### Online Detection
#### 5.3.2 Online Detection Performance  
The best CNAT model is deployed to implement online detection at the ingress router. We evaluated the CNAT model detection performance with a confusion matrix. The confusion matrix can visually represent each type of classification situation. Figure 11 shows the CNAT normalized confusion matrix performance for detecting various attacks.  
Figure 11a is the botnet normalized confusion matrix, and all four botnet types are above 0.85. The Ares, BYOB, and Mirai accuracy are all above 0.95, and these attack types have less traffic misidentified as other attack types. Among them, the Zeus accuracy is poor. Zeus and BYOB will continuously download necessary malicious files from the command and control (C&C) server. Their attack behaviors are analogous, which results in Zeus being misjudged as BYOB.  
Figure 11b is the network normalized confusion matrix. The ACK, SYN, and UDP attack behavior are not similar. The ACK attack means that the attack host sends a large number of ACK packets. The SYN attack means that the attack host sends a large number of SYN packets, and the UDP attack means that the attack host sends a large number of UDP packets. All three attacks are flood attacks, but the attack behaviors are different. The CNAT model can effectively learn the packet payload and header features, and the model can completely classify the three network attacks.  
Figure 11c is the LDDoS normalized confusion matrix. The Shrew and Slow Body accuracy can exceed 0.9. Show Read and Slow Headers are misidentified as other attacks. The Slow Read attacker sends a request file to the attack target, and the attack target reads the response data slowly. Therefore, the attacker and the attack target occupy the HTTP connection for a long time, so it may fail to respond to normal requests and services. The Slow Headers attackers continue to send incomplete packets, which can occupy HTTP resources all the time. Therefore, both of them occupy HTTP connections for a long time to generate denial of service, and their attack behaviors are similar. The Slow Headers and Slow Read attacks will misjudge each other. The Slow Headers accuracy reaches 0.43, and the Slow Read accuracy reaches 0.86.  
Figure 11d is the application normalized confusion matrix. The HTTP flood accuracy reaches 0.99. The CC and HTTP flood attackers simulate flood attacks, so a large number of CC attacks will be misjudged as HTTP flood attacks. Both HTTP Post and HTTP Get attacks set the Golden Eye tool parameters to simulate attack traffic. They are too similar and it is easy to confuse them. The HTTP Get attack and HTTP Post attack will misjudge each other. According to Figure 11d, the CNAT model has a poor performance in identifying application attacks. In the future, we will propose a detection model for application attacks that can learn application attack features and classify specific attacks with high performance.  
Figure 11: Normalized confusion matrix. (**a**) Botnet normalized confusion matrix; (**b**) Network normalized confusion matrix; (**c**) LDDoS normalized confusion matrix; (**d**) Application normalized confusion matrix; (**e**) DRDoS normalized confusion matrix.  
Figure 11e is the DRDoS normalized confusion matrix. The DRDoS attacker sends a small number of forged requests, eliciting a large number of responses from the server. All DRDoS attacks use the server to reflect traffic, but different DRDoS attacks have different specific traffic amplification principles. Therefore, the CNAT model can distinguish six types of DRDoS attacks with packet features, and the accuracy is above 0.95.  
In summary, we deployed the CNAT model to implement online attack detection. The model can effectively detect most DDoS types. The model malicious traffic detection capability is 86, and we reduced the malicious traffic at the ingress router.