# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 5 Experimental Results
### Offline Train
#### 5.2.4 Comparison with Other Methods  
In order to verify our proposed model for DDoS attacks, we compared it with the LSAT model [40] and the CNLS model [41]. Then, the best deep learning model has been selected for the online detection of DDoS attacks. The experiment used evaluation metrics in terms of response time, precision, recall, and malicious traffic detection capability. Table 6 gives the detection results. For the botnet multi-classification, it can be seen from Table 6 that CNAT has the highest malicious traffic detection capability. Compared with LSAT and CNLS, CNAT increased by 16 and 28, respectively. In the three methods, the Ares botnet precision and recall can reach more than 0.96. Regarding the BYOB botnet, LSAT has the highest precision, reaching 0.91. CNLS precision is 0.85 and CNAT precision is 0.81, respectively. CNAT has the highest recall, reaching 0.97. LSAT is reduced by 0.29 and CNLS is reduced by 0.27. For the Zeus botnet, LSAT has the highest precision of 0.99. CNAT has the highest recall of 0.93. In the three methods, the precision and recall of CNLS are lower than those of the other two methods, which are 0.44 and 0.09, respectively. The precision and recall of Mirai can reach more than 0.9. According to the above data analysis, the detection performance of CNAT and LSAT is the best, but the CNAT response time is the lowest. It takes 20 min to train the deep learning model. However, the response time of the other two algorithms is at least 100 min. The higher the complexity of the algorithm, the longer the neural network  
Figure 9: The model performance of different learning rates. training time. Considering the algorithm's complexity and limited hardware resources, CNAT has the best detection ability for botnet multi-classification. The LSAT, CNLS, and CNAT models have similar precision and recall for each traffic type at the network layer. The precision and recall rates are both 0.99. The malicious traffic detection capabilities of the three models are 99, but the CNAT response time is the lowest. For LDDoS attacks, the LSAT and CNLS malicious traffic detection capabilities are both 75. The malicious traffic detection capabilities of the CNAT model are 71. It can be seen from Table 6 that the LSAT model shows a large difference in the precision and recall of each traffic type. In particular, the Slow Read precision is only 0.57, and the Slow Headers precision is 0.76. The Slow Headers recall is 0.6. The precision and recall of the CNLS model for the five LDDoS are better than the LSAT model, but will produce 0.77 precision when we identify Slow Headers. Although the precision of Slow Read and the recall of Slow Headers of the CNAT model are lower than those of the other two models, the precision and recall of the CNAT model for identifying other traffic are better than those of CNLS. For Shrew attacks, the precision can reach 0.99, and the Slow Body precision can reach 0.95. The response time of the CNAT model is the shortest, at only 21 min. Therefore, the CNAT model has a lower response time and a better performance for LDDoS attacks. For application layer attacks, the CNLS model has the highest malicious traffic detection capability, reaching 64. For the CC attack, the precision of the CNLS model is the best, and the LSAT model has the best recall. For the HTTP Flood attack, the CNAT model has the best performance in terms of precision and recall. For the HTTP Get attack, the LSAT model has the best precision, reaching 0.79. The CNAT model has the best recall, reaching