# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 2 Related Work
### Neural Network Detection Method  
Neural networks are inspired by biological neurons and can also capture more complex patterns. With this method, researchers detect attacks and anomalies ([PERSON] et al., 2019). Convolutional networks have been widely used in natural language processing. In recent years, convolutional networks have also been used for malicious traffic detection with high accuracy. [PERSON] et al. [PERSON] et al. (2019) proposed an application traffic classification algorithm based on a convolutional neural network model. The model test is carried out through the CICAndmal2017 network open dataset. Comparison with the traditional machine learning traffic classification model indicates that the convolutional neural network model is increased by 2.93% and 11.87% in accuracy and recall, respectively. However, without fine-grained classification of malicious traffic, this author only identified malicious traffic from benign traffic. The 1 DCNN (1D Convolutional Neural Network) results are better performance than those of 2 DCNN (2D Convolutional Neural Network) to train long sequences of traffic data [PERSON] et al. (2019). The 1 DCNN is suitable for processing sequence data. [PERSON] et al. [PERSON] et al. (2019) proposed an end-to-end ISCX VPN-nonVPN encrypted traffic classification method with one-dimensional convolution neural networks. The experiment results on the public encrypted traffic dataset yielded significant improvements to the state-of-the-art method. However, this method is not validated in non-encrypted traffic. We chose a packet header and payload sequence features with 1 DCNN in our approach. With the development of neural networks, attention mechanisms are being proposed. [PERSON] et al. [PERSON] et al. (2019) proposed four ATS models with a Sequence-to-Sequence model. An attention-based bidirectional LSTM (Long Short-Term Memory) can enhance the correlation between the generated text summary and the source text, which can prevent the spread of cumulative errors in generated text summaries. The experiments confirm that the proposed ATS model has better performance than the baseline model. This article only applied LSAT (LSTM and Attention) in natural language processing. [PERSON] et al. [PERSON] et al. (2018) proposed a mechanism that combined LSCN (Long Short-Term Memory and Convolutional Neural Network) for efficient detection of multi-vector threats and attacks. The analysis showed that the proposed method outperforms other methods in terms of detection accuracy. [PERSON] et al. [PERSON] et al. (2019) proposed an attention mechanism composed of a channel attention module and a spatial attention module. The channel attention module processes the different channels' feature maps and makes the model pay more attention to those feature maps. The spatial attention module mainly processes the different feature positions on the feature map, which makes the model pay more attention to the specific feature positions. Because of the resource limitations of the hardware platform, we used the spatial attention module to capture the dependence of any two spatial features.  
In our approach, we combined 1 DCNN and an attention structure to classify malicious traffic for online attack detection. We used 1 DCNN to learn the packet header and payload features, utilized the attention mechanism to strengthen the neural network learning capability, and further fine-tuned the identification and classification. To verify our proposed model for DDoS attacks, we compared it with the LSAT model [40] and the LSCN model [41].  
In summary, firstly, we generated a self-generated dataset on the virtual platform. This dataset can stand in for traffic on the ground. Secondly, the proposed mechanism utilized similarity-based prior knowledge to distinguish benign flow from abnormal flow. Thirdly, the attention and convolutional neural network model fully learned features to detect various attacks at the ingress router.