# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 1 Introduction
Therefore, combined with [8; 9], this paper proposes an improved similarity method, which uses the probability distribution of packet size, packet length, flow rate, source port, and destination port (5- tuples) to represent benign traffic and abnormal traffic. The method can distinguish benign traffic from abnormal traffic at the ingress router. Recently, there have been some studies applying CNN (Convolutional Neural Network) to attack classification. CNN is better than other deep learning neural networks because it is good at extracting local features and down sampling features. The model is more suitable for processing data with more feature dimensions, such as images and text [10]. In this paper, we combine CNN and attention to extract features from the packet header and payload. The data packet header and payload features are extracted through a convolution operation, and the generated feature map is input into the attention mechanism to capture the dependence of any position of the feature map and effectively classify DDoS. In addition, [11; 12] introduced the network topology and traffic generation mode creating self-generated datasets and studied how to use attack tools to generate DDoS attacks datasets on the experimental attack and defense platform, respectively. However, the massive benign traffic is not simulated in a 5G scenario. Researchers have used many datasets [13; 14; 15] to evaluate the performance of their proposed intrusion detection and intrusion prevention methods. These datasets are outdated, so cannot reflect current attack types and attack methods. Therefore, collecting real datasets is a very important intrusion detection task [16]. This paper proposes a two-stage intelligent detection method for the 5G network. First, the self-generated dataset is obtained by simulating different types of attacks and 5G benign behaviors. Second, we analyze the attack behavior to select the 5-tuple features, and the similarity-based prior knowledge model is established the 5-tuple features probability distribution. This can help distinguish between benign traffic and abnormal traffic. Third, the CNN-based attention model trains abnormal traffic and optimizes the detection model. Finally, the two-stage intelligent detection model is deployed at the ingress router to achieve online detection for classifying 21 kinds of DDoS. The contribution of this article is as follows:  
1. We generate a self-generated dataset that conforms to the actual traffic. The experiment simulates a large amount of benign traffic and different types of DDoS attack traffic in 5G scenarios. 2. We propose a two-stage intelligent detection model. The model includes the similarity-based prior knowledge model and the CNN-based attention model. A similarity-based prior knowledge detection method for DDoS attacks is proposed. Through attack behavior analysis, we select five representative features. The probability distribution of the features is used to build a model based on the similarity with prior knowledge. The model can distinguish DDoS from benign traffic. * A CNN-based attention DDoS attack detection method is proposed. The CNN-based attention detection model deeply learns 29 packet payload and packet header statistical features, selects the model's best parameters, and indicates the specific types of DDoS attacks. * We define a malicious detection capability metric. We apply the defined metric and common metrics to evaluate the proposed mechanism. By comparing with benchmark statistics and neural network algorithms, we show that the proposed approach performs well in terms of the detection rate, malicious detection capability, and response time. The remainder of this paper is organized as follows. Section 2 introduces recent related work on the network intrusion detection method and dataset. Section 3 describes the proposed detection model. Section 4 presents dataset construction and evaluation metrics. Section 5 analyzes the experimental results. Section 6 concludes the paper.