# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 4 Methodology
### Dataset
The dataset is publicly available at [[https://github.com/liliMpro/source_dataset](https://github.com/liliMpro/source_dataset)]([https://github.com/liliMpro/source_dataset](https://github.com/liliMpro/source_dataset)) (accessed on 22 February 2022). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Collection Time** & **SrcIP** & **DstIP** & **Label** \\ \hline \multirow{4}{*}{11 May 2021, 20.00–23.50} & 10.1.0.20–10.1.0 & 10.1.1.1 & Benign \\ \cline{2-4}  & 10.1.0.1 & 10.1.1.1 & Ares \\ \cline{2-4}  & 10.1.0.2 & 10.1.1.2 & BYOB \\ \cline{2-4}  & 10.1.0.4 & 10.1.1.4 & Mirai \\ \cline{2-4}  & 10.1.0.7 & 10.1.1.99 & Zeus \\ \hline \multirow{4}{*}{22 May 2021, 15:31–15:56} & 12.1.0.2 & 12.1.1.1 & HTTP-Flood \\ \cline{2-4}  & 12.1.0.3 & 12.1.1.1 & HTTP-Post \\ \cline{2-4}  & 12.1.0.4 & 12.1.1.1 & HTTP-Get \\ \cline{2-4}  & 12.1.1.20–12.1.1.30 & 12.1.0.3 & Benign \\ \hline \multirow{4}{*}{22 May 2021, 20:14–20.25} & 12.1.0.4 & 12.1.0.3 & Memcached, Chargen, NTP, SSDP, SNMP, TFTP \\ \cline{2-4}  & 12.1.1.20–12.1.1.30 & 12.1.0.3 & Benign \\ \hline \multirow{4}{*}{23 May 2021, 11:08–11:11} & 13.1.0.3 & 13.1.1.1 & SYN \\ \cline{2-4}  & 13.1.0.20–13.1.0.30 & 13.1.1.1.1 & Benign \\ \hline \hline \end{tabular}
\end{table} 
Table 2: DDoS datasets timetable. We obtained the network traffic pcap file at the ingress router, and used the CIFlowmeter tool to extract the flow feature information of the traffic to obtain the multi-type DDoS attack dataset. Table 3 shows the flow type, number of data samples, and ratio. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Collection Time** & **SrcIP** & **DstIP** & **Label** \\ \hline
23 May 2021, & 13.1.0.2 & 13.1.1.1 & ACK \\
11:13–11:16 & 13.1.0.20–13.1.0.30 & 13.1.1.1 & Benign \\ \hline
23 May 2021, & 13.1.0.1 & 13.1.1.1 & UDP \\
11:18–11:21 & 13.1.0.20–13.1.0.30 & 13.1.1.1 & Benign \\ \hline  & 11.1.0.1 & 11.1.1.1 & Slow Headers \\ \cline{2-4}
23 May 2021, & 11.1.0.2 & 11.1.1.1 & Slow Body \\
15:35–16:15 & 11.1.0.3 & 11.1.1.1 & Slow Read \\ \cline{2-4}  & 11.1.0.4 & 11.1.1.1 & Shrew \\ \cline{2-4}  & 11.1.0.20–11.1.0.30 & 11.1.1.1 & Benign \\ \hline \hline \end{tabular}
\end{table} 
Table 2: _Cont._ \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Type** & **Proportion** & **Number** \\ \hline Benign & Benign & 0.3127 & 880,693 \\ \hline \multirow{3}{*}{Network DDoS} & ACK & 0.0465 & 131,072 \\ \cline{2-4}  & UDP & 0.0464 & 130,844 \\ \cline{2-4}  & SYN & 0.0448 & 126,415 \\ \hline \multirow{3}{*}{LDDoS} & SlowBody & 0.0348 & 98,148 \\ \cline{2-4}  & Shrew & 0.0157 & 44,280 \\ \cline{2-4}  & SlowHeaders & 0.0342 & 96,542 \\ \cline{2-4}  & SlowRead & 0.023 & 64,997 \\ \hline \multirow{3}{*}{Botnet} & Ares & 0.252 & 709,748 \\ \cline{2-4}  & BYOB & 0.001 & 2926 \\ \cline{2-4}  & Mirai & 0.0007 & 2251 \\ \cline{2-4}  & Zeus & 0.0001 & 327 \\ \hline \multirow{3}{*}{DRDoS} & TFIP & 0.0141 & 39,977 \\ \cline{2-4}  & Memcached & 0.0137 & 38,586 \\ \cline{2-4}  & SSDP & 0.0044 & 12,513 \\ \cline{2-4}  & NTP & 0.0033 & 9319 \\ \cline{2-4}  & Chargen & 0.0004 & 1269 \\ \cline{2-4}  & SNMP & 0.0002 & 582 \\ \hline \multirow{3}{*}{Application DDoS} & CC & 0.09 & 253,525 \\ \cline{2-4}  & HTTP-Get & 0.0225 & 3435 \\ \cline{1-1} \cline{2-4}  & HTTP-Flood & 0.0202 & 56,886 \\ \cline{1-1} \cline{2-4}  & HTTP-Post & 0.0183 & 51,556 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Traffic type and number.