# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 3 Detection Model
### Neural Network Detection Model  
We proposed a neural detection algorithm, named CNAT, combining CNN and attention structure to classify malicious traffic for online attack detection. However, we took the online detection time requirements into account. Thus, this article only uses the spatial attention mechanism to learn features and classify multiple attacks. Figure 2 shows the CNN-based attention model. The function of every layer is as follows:  
Input Layer: We extracted the features of the packet header and payload in the abnormal traffic obtained by the MFPK detection method. In this first layer, it takes as input a traffic flow represented by a feature matrix F of size \(p*f\). F contains individual p flow vectors in the interval window \(\Delta\)T, and each flow vector f is 29. CNN layer: We used 1 DCNN to train the flow features. We input these features into the feature detection suitable for processing packets' statistical features. Each input feature matrix F was operated on by a single convolutional layer with e filters of size \(h*f\), where \(h\) is the height of each filter, and \(f\) is 29. Each filter covered F with a step of s to extract and learn the packet statistical features, which contains useful information for classifying DDoS. Then, each of the e filters generated a feature map of size \(p-h+1\). We utilize the activation function to minimize the error between the true label and the predicted label. The ReLU and sigmoid are common activation functions. We introduced the ReLU activation function since ReLU is proven to be faster to train than standard sigmoid units [45], so we use the rectified linear function \(\text{ReLU}(x)=\max\{0,\ x\}\). Attention layer: The attention mechanism can encode the sequence packet header and payload feature, and assign a weight to each feature determined by the feature similarity between the corresponding two locations. In Figure 2, after convolutional layers, the attention layer includes query \(Q\), key \(K\), and value \(V\). \(Q\), \(K\), and \(V\) are defined as follows:  
\[Q=W^{\text{q}}F;K=W^{\text{k}}F;V=W^{\text{v}}F \tag{11}\]  
In Equation (11), the \(W^{\text{q}}\) is the query matrix, \(W^{\text{k}}\) is the key matrix, and \(W^{\text{v}}\) is the value matrix. These three matrices are learned through a neural network. Based on Equation (11), \(Q\), \(K\), and \(V\) are generated after convolutional layers. The similarity \(S_{ji}\) between features is calculated by \(Q\) and \(K\). The similarity \(S_{ji}\) is the attention weight. The value V is operated by each attention weight with a weighted sum method. The similarity \(S_{ji}\) is as follows:  
\[S_{ji}=\frac{\exp\bigl{(}Q_{i}\cdot K_{j}\bigr{)}}{\sum\limits_{i=1}^{f}\ \exp \bigl{(}Q_{i}\cdot K_{j}\bigr{)}} \tag{12}\]  
In Equation (12), \(Q_{i}\) and \(K_{j}\) are the encode with the \(i\)-th feature and the \(j\)-th feature, respectively. \(S_{ji}\) is the matching degree between the \(j\)-th feature and the \(i\)-th feature. \[C_{\text{j}}=\sum\limits_{\text{j=1}}^{f}S_{\text{ji}}V_{\text{j}} \tag{13}\]  
In Equation (13), \(C_{j}\) is the features matrix aggregated by the attention module; \(f\) is the feature number; and \(V_{j}\) is the encoder for the \(\text{j-th}\) feature. The attention module can improve any two feature positions similarly. Finally, the features matrix \(C_{j}\) aggregates by the attention module. Dense layer: \(C_{j}\) is an input to the dense layer. We used the optimization function to minimize the loss between the real value and the predicted value. The optimization function and learning rate affect the model performance. An appropriate learning rate  
Figure 2: CNN-attention model. can reduce the error during back propagation. During back propagation, weight and bias are important parameters. Weight is the real value that is associated with each feature. Bias is to better fit the data. The model can continuously update the convolutional weight and bias.