# Two-Stage Intelligent Model for Detecting Malicious DDoS Behavior
## 4 Methodology
### Dataset  
The experimental platform is built based on Vmware vSphere software ([[http://www.vmware.com/cn.html](http://www.vmware.com/cn.html)]([http://www.vmware.com/cn.html](http://www.vmware.com/cn.html)) (accessed on 9 January 2021)). The specific configuration of the virtual machine is shown in Table 1.  
The software environment is the Ubuntu18.04 Server system, the number of virtual cores is 8, and the memory is 16 GB. The topological structure adopted is shown in Figure 3. We simulated multiple types of botnets, application layers, network layers, low-rate, DRDoS attacks, and benign traffic of multiple 5G scenarios in the virtual machine. The attack domain deploys the attack tools and scripts in Figure 3. After the attackers execute the tools or scripts, malicious and normal behaviors pass the ingress router to reach the target domain. The following five types of attacks are involved in the experimental platform:  
Low-rate DDoS: In the LDDoS area, we used eight hosts, including two routers, four attack hosts, and two web servers. The attack hosts used Slow HTTPest ([[https://github.com/shekyan/slowhttptest/](https://github.com/shekyan/slowhttptest/)]([https://github.com/shekyan/slowhttptest/](https://github.com/shekyan/slowhttptest/)) (accessed on 11 March 2021)) to send LDDoS attacks to the web server. The LDDoS attacks included slow headers, slow body, shrew, and slow read. \begin{table}
\begin{tabular}{c c} \hline \hline
**Input**: The feature matrix **F**; the filter e; the feature number **f**; the maximum number of iterations **R**; the convolution filter weight **w**; the convolution filter bias **b**; the query matrix **W***q**; the key matrix **W***k**; the key matrix **W***v**; **Output**: The traffic type; 1: **for** epoches = 1 to \(E\)**do** 2: initial to we be 0; b to be 0;
3: **for**\(r=1\) to **R**do** 3: **for**\(j=1\) **R**do** 4: \(z^{[r]}=w^{[r]}\textbf{f}+b^{[r]}\), 5: \(\textbf{F}^{[r]}=\text{Relu}(z^{[r]}+b^{[r]})\);
6: **end for** 4: \(Q=W^{q}F_{i}K=W^{k}F_{i}V=W^{\text{v}}F\) 5: \(S_{ji}=\frac{\exp(Q:K_{ij})}{\sum\limits_{i=1}^{E}\exp(Q:K_{ij})}\);
6: \(C_{j}=\sum\limits_{j=1}^{E}s_{ji}V_{j}\);
7: **end for** 5: Add dense layer, classification layer 12: **return** The traffic label;  
\end{table} 
Table 1: Virtual machine configuration. Application Layer DDoS: we utilized four hosts to generate four application layer DDoS. We separately used the Hulk ([[https://dl.packestormsecurity.net/DoS/hulk.zip](https://dl.packestormsecurity.net/DoS/hulk.zip)]([https://dl.packestormsecurity.net/DoS/hulk.zip](https://dl.packestormsecurity.net/DoS/hulk.zip)) (accessed on 5 February 2021)), Webbench ([[http://www.ha97.com/4623.html](http://www.ha97.com/4623.html)]([http://www.ha97.com/4623.html](http://www.ha97.com/4623.html)) (accessed on 5 February 2021)), and Golden Eye tools ([[https://github.com/jesidl/GoldenEye](https://github.com/jesidl/GoldenEye)]([https://github.com/jesidl/GoldenEye](https://github.com/jesidl/GoldenEye)) (accessed on 5 February 2021)) to simulate HTTP Flood attack, CC (Challenge Collapsar) attack, HTTP Post attack, and HTTP Get attack. DRDoS: In the reflection amplification attack domain, we used one attack host and two servers. The attacker used the Scapy library ([[https://scapy.net](https://scapy.net)]([https://scapy.net](https://scapy.net)) (accessed on 18 February 2021)) to send fake requests to the two servers to generate DRDoS attack traffic, including Memcached, TFTP (Trivial File Transfer Protocol), Chargen, NTP (Network Time Protocol), SNMP (Simple Network Management Protocol), and SSDP (Simple Service Discovery Protocol). The victim host receives a large number of responses from the server. Botnet attack: In the zombie attack domain, we used four hosts and four control command servers. The control and command server are used to maintain the connection with the zombie host.