# Optimization Enabled Deep Learning-Based DDoS Attack Detection in Cloud Computing

Authors: S. Balasubramaniam; C. Vijesh Joe; T. A. Sivakumar; A. Prasanth; K. Satheesh Kumar; V. Kavitha; Rajesh Kumar Dhanaraj
Journal: International Journal of Intelligent Systems
 (2023)

---

## Abstract

Cloud computing is a vast revolution in information technology (IT) that inhibits scalable and virtualized sources to end users with low infrastructure cost and maintenance. They also have much flexibility and these resources are supervised by various management organizations and provided over the Internet by known standards, formats, and networking protocols. Legacy protocols and underlying technologies consist of vulnerabilities and bugs which open doors for intrusion by network attackers. Attacks as distributed denial of service (DDoS) are one of most frequent attacks, which impose heavy damage and affect performance of the cloud. In this research work, DDoS attack detection is easily identified in an optimized way through a novel algorithm, namely, the proposed gradient hybrid leader optimization (GHLBO) algorithm. This optimized algorithm is responsible to train a deep stacked autoencoder (DSA) that detects the attack in an efficient manner. Here, fusion of features is carried out by deep maxout network (DMN) with an overlap coefficient, and augmentation of data is carried out by the oversampling process. Furthermore, the proposed GHLBO is generated by integrating the gradient descent and hybrid leader-based optimization (HLBO) algorithm. Also, this proposed method is assessed by various performance metrics, such as the true positive rate (TPR), true negative rate (TNR), and testing accuracy with values attained as 0.909, 0.909, and 0.917, accordingly.


---

## Body

## 1. Introduction

Cloud computing is an Internet-enabled platform for delivering computing facilities, including networking, servers, and databases to users or employers in organizations at huge scale, and helps companies with cost reduction for a particular organization [1]. Nowadays, cloud computing is growing as the standard platform for distributing large data pool that provides various user-friendly features. Most services related to cloud computing are of pay on demand type in which each and every user is allocated by discrete pool of devices used for data mining. Services of cloud computing are classified as IaaS, SaaS, and PaaS [2]. Cloud computing helps organizations or users to reduce the cost of infrastructure by supplementing various online resources that are in the form of services. In cloud computing, organizations or users pay only for service time based on duration in accordance to the pay-as-you-use policy. This service availability is very important and beneficial to users or organizations; else they have to tolerate big financial issues with or without reputation loss [3]. Default keys are used by cloud devices that have no roles on security on acoustics which make them susceptible for negotiation. Cloud system contamination is frequently ignored by the user, and without proper awareness of owners in service, hundreds to thousands of devices are theoretically mistreated by the attacker for large-scale attack [4]. Technology advancement also has serious issues in the cloud and one of these threats is DoS. DoS creates unavailability of network services; however, this unavailability of services is the result of various other reasons, such as faults in software or cloud component [5].DDoS attack is a common category of cyber-attack, which creates unauthorized and disturbed services to network users [6] that is utilized by attackers to avoid authentic users from retrieving services [1, 7]. Attackers use these DDoS attacks not to be available for authentic users [8]. Here, attackers put heavy load on network services provided by target server on public. Network known botnet of numerous hosts in Internet is used for distributing traffic to victim or user. Amplification and reflection techniques lead this DDoS attack to a much destructive state [3]. These attacks are carried out by compromising and exploiting hundreds to thousands of hosts, termed zombies, which execute attack against the machine of target. They disturb regular and normal traffic on a network via sudden exponential upsurge in traffic and lastly prevent regular traffic from attaining its terminus. DDoS is considered as a type of malicious attack on cloud servers that creates many severe problems [9]. These attacks generate large network traffic containing packets sent on the network, making regular users in trouble who want to obtain services that not respond to their requirements [6, 7]. Packets are categorized as normal or malicious based on DDoS defense methods, and these methods fall under two major types, (1) the signature-based method and (2) the anomaly-based method. Signature-based methods use many attack signatures situated in the knowledge database to detect attacks and effectively find known attacks. In the meantime, anomaly-based techniques analyse regular normal traffic behavioural patterns in a particular period for detecting deviation in the steady action and analyse the zero-day attack [2].The DL system is very efficient in discriminating traffic of DDoS from benign traffic by extracting representations of traffic of the high-level feature from traffic of the low level [10]. Efficient disposition of technologies under security, including access control, cloud encryption, malware identification, and secure uploading is achieved by DL and computers [4]. It is suited for modelling a nonlinear complex relationship by learning various stages of representation that correspond to multiple stages of abstraction. DNN has a cascade of multiple layers of processing units, which is nonlinear for transformation and extracting features, that is, a promising technique for identifying attacks in social network [11]. Detecting a cyber-attack shares the feature that is common with the recognition of image, which harnessed new features of DL. Small changes in the pixel tend to identify image changes where attack is detected in the same way as more than 99 percentage of novel attacks are minor mutants of previous attacks. This reinforces efficiency of DL for detecting minor changes in patterns of attacks [12]. Unsupervised SA in DL learns representations from an unbalanced dataset that uses DT as the binary classifier for detecting attacks from newly merged representations [13]. DL is applied to cyber security because of the capability of self-learning and analyzing. Web attack detection within URLs from attackers and normal users by DL is a challenging task, and major problems include the following: (i) an effective way for transforming every kind of URL into representations is very important in view of multiple ways as various attacks hide in respective URLs, (ii) various attacks show various signatures in URLs, and thus selecting a feature is not much easy, and (iii) most DL applications in cyber security have one model to do detection, and it is difficult to update the system [14].This work is concentrated in detecting DDoS attacks in cloud computing using the DL method, trained by an optimized algorithm. Here, the proposed optimization algorithm is named as GHLBO, which is generated by incorporating gradient descent with HLBO algorithm. Different stages involved for model detection are feature fusion, data augmentation, and finally attack detection. Here, process of fusion of features is carried out by DMN using an overlap coefficient, which is then followed by using data augmentation carried out by oversampling. Next to augmentation of data, the DDoS attack is detected by DSA that is trained by proposed GHLBO.The main contributions of this article are as follows:(i)
developed GHLBO algorithm enabled DSA: estimating a DDoS attack is carried out using designed GHLBO, created by the collaboration of the gradient descent and HLBO algorithm. This GHLBO trains DSA for estimating or detecting a DDoS attack in cloud computing.The remaining parts of this article include the following: Section2 represents the literature review of attack detection and Section 3 represents the elaborate particulars of the proposed GHLBO-based DSA. Section 5 represents discussions with results of the developed model, and this article is concluded in Section 6.


## 2. Motivation

DDoS attack detection is much needed for helping the legitimate users to carefully access to network services. Multiple techniques are available for this detection; but those techniques are hard to trace back to attacker and not effective to mitigate these attacks. To overcome these problems, there is a need to adopt a best detection method. Hence, this proposed GHLBO-enabled DSA represents an optimal way for DDoS detection. This section also enhances literature reviews regarding current detection techniques along with uses, drawbacks, and challenges.


### 2.1. Literature Assessment

Assessment of reviews from literature of various researchers regarding DDoS detection in cloud computing is given as follows: Velliangiri et al. [2] proposed TEHO-enabled DBN, which was used to identify attacks at earlier stages itself. But this method followed more iterations, TEHO-DBN for updating weights of input and hidden units of the MLP layer that tend to have more computational time. This drawback was overcome by Arul and Punidha [4], where SD-LVQ was developed; here, the cloud-mounted computer function was evaluated to reduce detection strategies of the DDoS-encrypted cross-site attack. However, the challenge by deep-supervised methods over the hybrid cloud data centre remained. Challenge in [4] was eradicated in [10]. Doriguzzi-Corin et al. [10] designed LUCID model architecture, which followed the lightweight application with less overhead processing and minimal time of detection. But time of convergence and accuracy was low in this method. This low convergence was removed in [15]. Agarwal et al. [15] developed FS-WOA, in which DDoS attack entry in the big-scale industry was avoided. However, this method lacks in generating individual instantiations to detect novel attacks.Kushwaha and Ranga [3] proposed SaE-ELM-Ca. Although this method was designed to inevitably determine the appropriate hidden neurons number to improvise model’s learning capability, this method failed to utilize multiple connections for testing and instead used single connection. This drawback was hopefully eradicated in [1]. Alduailij et al. [1] proposed MI and RFF, which was helpful to reduce misclassification errors by using various classifiers. However, this method failed to examine with DL-based detection and this DL-based detection was enhanced in [9]. Alqarni [9] introduced the ensemble approach for DDoS detection that limited the size of the feature and dataset producing higher performance. Here, drawbacks prevailed in its time of execution, which lasted for more time. Usage of time was limited by Cil et al. [6], where feed forward-based DNN was designed. This method attained accurate and fast results within a shorter period of time. But this method preferred the compulsory training process as a large number of packages were contained in the dataset, which was not preferred in other existing approaches. Bovenzi et al. [16] implemented the MultiModal Deep AutoEncoder (M2-DAE) model for identifying the intrusions in IoT. This approach was fitted for privacy-preserving and distributed methods with high efficiency and flexibility. However, the attack classes were not evaluated in this approach. Guarino et al. [17] implemented a machine learning approach for classifying the attacks in the network. Here, an advanced set of features were considered for the early classification. This approach obtained high F-measure, but more datasets were not considered.The review on existing methods is shown in Table1.Table 1
Review on existing methods.
ReferencesMethodsAdvantagesDisadvantagesVelliangiri et al. [2]TEHO-DBN(i) It identified the attack at earlier stages itself(i) It required more computational timeArul and Punidha [4]SD-LVQ(i) It reduced the detection strategies of the DDoS-encrypted cross-site attack(i) Difficult to process a large amount of dataDoriguzzi-Corin et al. [10]LUCID(i) Less overhead processing and minimal time of detection(i) Time of convergence and accuracy were lowAgarwal et al. [15]FS-WOA(i) It avoided DoS attack entry in a big-scale industry(i) This method lacks in generating individual instantiations to detect novel attacksKushwaha and Ranga [3]SaE-ELM-Ca(i) It determined appropriate hidden neurons number to improvise model’s learning capability(i) It failed to utilize multiple connections for testingAlduailij et al. [1]MI and RFF(i) It reduced miss classification error(i) It failed to examine with DL-based detectionAlqarni [9]Ensemble approach(i) Limited the size of the feature and dataset producing higher performance(i) Time of execution was highCil et al. [6]Feed forward-based DNN(i) It attained accurate and fast results within a shorter period of time(i) It preferred the compulsory training process as the large number of packages was contained in the datasetBovenzi et al. [16]M2-DAE(i) It had high efficiency and flexibility(i) The attack classes were not evaluatedGuarino et al. [17]Machine learning(i) It obtained high F-measure(i) More datasets were not considered


### 2.2. Challenges

Some challenges confronted by the predominant DDoS attack in cloud computing techniques are described as follows:(i)
Probable challenge in [10] is providing proper balancing among usages of the LUCID resource including preprocessing and traffic collection, with detection accuracy that means to ensure the obligatory level of protection against DDoS attacks without making delays to services.(ii)
In method [1], MI feature selection only was utilized as this required much time with increased data dimensions for detecting an attack, whereas other feature selection techniques, such as wrapper and sequential feature selection, were not adopted for detecting DDoS and various other attacks.(iii)
The ensemble approach in [9] utilized decision trees, naive Bayes, K-NN, and SVMs as base classifiers for detecting DDoS in cloud computing with high accuracy; however, other classifiers used in this method, performed less in detection.(iv)
CIC-DDoS2019 dataset used in [6] was converted into dual various formats for efficient classification and detection of DDoS, but this method had a challenge in detecting real-time DDoS attacks and failed to check recording network traffic from IoT and VMs.(v)
Cloud computing services are usually used as a private or public data forum depending on request by humans, and its increased utilization led to various security concerns. Informative data in cloud comes under problematic threat due to network hackers, and still, it is a challenging task to detect attacks because unauthorized users can also access cloud systems, which is a weakest point of security.


## 2.1. Literature Assessment

Assessment of reviews from literature of various researchers regarding DDoS detection in cloud computing is given as follows: Velliangiri et al. [2] proposed TEHO-enabled DBN, which was used to identify attacks at earlier stages itself. But this method followed more iterations, TEHO-DBN for updating weights of input and hidden units of the MLP layer that tend to have more computational time. This drawback was overcome by Arul and Punidha [4], where SD-LVQ was developed; here, the cloud-mounted computer function was evaluated to reduce detection strategies of the DDoS-encrypted cross-site attack. However, the challenge by deep-supervised methods over the hybrid cloud data centre remained. Challenge in [4] was eradicated in [10]. Doriguzzi-Corin et al. [10] designed LUCID model architecture, which followed the lightweight application with less overhead processing and minimal time of detection. But time of convergence and accuracy was low in this method. This low convergence was removed in [15]. Agarwal et al. [15] developed FS-WOA, in which DDoS attack entry in the big-scale industry was avoided. However, this method lacks in generating individual instantiations to detect novel attacks.Kushwaha and Ranga [3] proposed SaE-ELM-Ca. Although this method was designed to inevitably determine the appropriate hidden neurons number to improvise model’s learning capability, this method failed to utilize multiple connections for testing and instead used single connection. This drawback was hopefully eradicated in [1]. Alduailij et al. [1] proposed MI and RFF, which was helpful to reduce misclassification errors by using various classifiers. However, this method failed to examine with DL-based detection and this DL-based detection was enhanced in [9]. Alqarni [9] introduced the ensemble approach for DDoS detection that limited the size of the feature and dataset producing higher performance. Here, drawbacks prevailed in its time of execution, which lasted for more time. Usage of time was limited by Cil et al. [6], where feed forward-based DNN was designed. This method attained accurate and fast results within a shorter period of time. But this method preferred the compulsory training process as a large number of packages were contained in the dataset, which was not preferred in other existing approaches. Bovenzi et al. [16] implemented the MultiModal Deep AutoEncoder (M2-DAE) model for identifying the intrusions in IoT. This approach was fitted for privacy-preserving and distributed methods with high efficiency and flexibility. However, the attack classes were not evaluated in this approach. Guarino et al. [17] implemented a machine learning approach for classifying the attacks in the network. Here, an advanced set of features were considered for the early classification. This approach obtained high F-measure, but more datasets were not considered.The review on existing methods is shown in Table1.Table 1
Review on existing methods.
ReferencesMethodsAdvantagesDisadvantagesVelliangiri et al. [2]TEHO-DBN(i) It identified the attack at earlier stages itself(i) It required more computational timeArul and Punidha [4]SD-LVQ(i) It reduced the detection strategies of the DDoS-encrypted cross-site attack(i) Difficult to process a large amount of dataDoriguzzi-Corin et al. [10]LUCID(i) Less overhead processing and minimal time of detection(i) Time of convergence and accuracy were lowAgarwal et al. [15]FS-WOA(i) It avoided DoS attack entry in a big-scale industry(i) This method lacks in generating individual instantiations to detect novel attacksKushwaha and Ranga [3]SaE-ELM-Ca(i) It determined appropriate hidden neurons number to improvise model’s learning capability(i) It failed to utilize multiple connections for testingAlduailij et al. [1]MI and RFF(i) It reduced miss classification error(i) It failed to examine with DL-based detectionAlqarni [9]Ensemble approach(i) Limited the size of the feature and dataset producing higher performance(i) Time of execution was highCil et al. [6]Feed forward-based DNN(i) It attained accurate and fast results within a shorter period of time(i) It preferred the compulsory training process as the large number of packages was contained in the datasetBovenzi et al. [16]M2-DAE(i) It had high efficiency and flexibility(i) The attack classes were not evaluatedGuarino et al. [17]Machine learning(i) It obtained high F-measure(i) More datasets were not considered


## 2.2. Challenges

Some challenges confronted by the predominant DDoS attack in cloud computing techniques are described as follows:(i)
Probable challenge in [10] is providing proper balancing among usages of the LUCID resource including preprocessing and traffic collection, with detection accuracy that means to ensure the obligatory level of protection against DDoS attacks without making delays to services.(ii)
In method [1], MI feature selection only was utilized as this required much time with increased data dimensions for detecting an attack, whereas other feature selection techniques, such as wrapper and sequential feature selection, were not adopted for detecting DDoS and various other attacks.(iii)
The ensemble approach in [9] utilized decision trees, naive Bayes, K-NN, and SVMs as base classifiers for detecting DDoS in cloud computing with high accuracy; however, other classifiers used in this method, performed less in detection.(iv)
CIC-DDoS2019 dataset used in [6] was converted into dual various formats for efficient classification and detection of DDoS, but this method had a challenge in detecting real-time DDoS attacks and failed to check recording network traffic from IoT and VMs.(v)
Cloud computing services are usually used as a private or public data forum depending on request by humans, and its increased utilization led to various security concerns. Informative data in cloud comes under problematic threat due to network hackers, and still, it is a challenging task to detect attacks because unauthorized users can also access cloud systems, which is a weakest point of security.


## 3. Cloud Model

Services of cloud computing [2] have a vast number of resource pool for data mining services and allow millions of users to store, modify, and edit data. Cloud computing exhibits environment for storage of more amount of data. The cloud model consists of two important devices, known as VM and PM. The control environment in cloud computing is considered as the cloud server. Moreover, the cloud model has the resource scheduler and allocator for resource allocations. Based on request of a user, the resource scheduler assigns available resources for processing data. PM controls multiple VM operations, and VM computes devices for storing and processing data. Scheduler controls various requests and connections by providing resources consequently in an orderly manner. The DDoS attack defence system is directly linked to the resource scheduler, as this monitor presence of behaviour of anomaly in the system in a continuous manner. While the request of the user happens inside system, then the defence strategy checks the network of traffic and announces sensible request or delivers it as an attack. When this defence strategy finds the DDoS attack, then this notifies cloud server directly.


## 4. Developed GHLBO-Enabled DSA for DDoS Attack Detection

DDoS attacks are most serious issue among security in the network and cause risks in the cloud computing environment. Goal of this research is finding DDoS in cloud computing based on DL. Initially, simulation on cloud is carried out, and it creates a log file, which has abrupt information and this information is directed for further feature fusion. This feature fusion is carried out using DMN [18] with the overlap coefficient. After the process of fusion of features, the data are augmented by oversampling. Next to data augmentation, DDoS attack detection is carried out using DSA [19], which is trained using the proposed optimization algorithm, named GHLBO. The GHLBO will be designed newly by integrating the gradient descent [20] and HLBO algorithm [21]. Figure 1 shows the block diagram for the proposed GHLBO enabled feature fusion for DDOS attack detection in cloud computing.Figure 1
Block diagram for the proposed GHLBO enabled feature fusion for DDoS detection on the attack in cloud computing.


### 4.1. Log File Creation

The initial phase of designed DDoS detection on attacks is creating a log file that is indicated asA. Users of the cloud system access to the model of cloud via the allocator or resource scheduler. The resource allocation model consists of data regarding free devices that allocates the device to a user based on their necessities. The resource scheduler identifies every information on the log file of each user to generate A. Abrupt information is available in the log file that is unable to be directly utilized for training [2]. The log file contains the IP address and its log information that is considered as features. The original data size obtained from datasets like BOT-IoT is in the size of 100000×48 and NSL-KDD is of 10000×42. The representation of the log file with features is given as(1)A=f1,f2,…,fn,where f1 and f2 represent the features in the log file and n represents the complete account of features.


### 4.2. Feature Fusion Based on DMN with the Overlap Coefficient

After the construction ofA, the next step is feature fusion based on DMN [18] with the overlap coefficient. Features that are taken from the log file are fused before the detection of DDoS as this may lead to identification of attack easily.


#### 4.2.1. Arranging Features Based on Overlap Coefficient

Features are to be arranged based on the relativeness of their closeness character for making data in the readable format and for optimizing the rate of detection. The arrangement of features is carried out by the overlap coefficient that arranges features based on their measured closeness features. The overlap coefficient is represented as(2)Ocf1,f3=f1∩f3minf1f3,where f1 and f3 represent features with the same closeness character.


#### 4.2.2. Fusion

After the arrangement of features according to the same measured closeness, they are fused so that independent features are converted to a unique feature in order to process easily. Fusion formula is expressed as(3)F=∑a=1b∂dpa,where F denotes the fusion of features expressed in the vector form, b is the maximum feature range, and d indicates the full feature account. Furthermore, the generation of F is carried out based on the following formula for a as(4)a=b−Kd,where d is the first obtained based on K and t, which is formulated as(5)d=Kt;1≤s≤t,where K is for full amount of features and t indicates the features selected. Here, the feature size is changed to Fo×k from the initial size Fo×b.


#### 4.2.3. Generating∂ Using the Deep Maxout Network

The fractional coefficient∂ is generated for finding the feature fusion depending on the overlap coefficient and data records. DMN is trained to find the fractional coefficient and the architecture of DMN is explained as follows:(1) Architecture of DMN.DMN [18] is one of the neural network’s types, which has many numbers of layers that create hidden activations via the maxout function. Here, functions on activation are exemplified by the nth layer, where hidden units are characterized to various disjunct groups. In DMN, the activation function is replaced by MMN weights and maxout units. Maxout is a common category of ReLU which achieves the maximum operation on altered linear representations. The maxout unit-based result [22] is formulated as(6)CzE∇=maxe∈1,mIze,where Ize=E∇ΑΒ....ze+GGze is the parameter that is trained and m is the total number of units of subhidden linear terms.Feature maps are formed by layering conv filters along the MMNs activation function above the local patch, and this is fed into further higher layers. Here, every hidden neuron is the maxout unit, which is denoted as multilayer generalization guarding maxout behavior, while improving construction capability of various distributions of latent ideas. This MMN is a kind of a activation function for training. Assuming input asE∇, which is the hidden layer raw input vector, activation function is expressed as follows:(7)Χz,e1=maxe∈1,m1E∇ΑΒ⋯⋅⋅ze+Ggze,Χz,e2=maxe∈1,m2Χz,e1ΑΒ⋯⋅⋅ze+Ggze,Χz,eh=maxe∈1,miHz,ei−1ΑΒ⋯⋅⋅ze+Ggze,Χz,ej=maxe∈1,mjΧz,ej−1ΑΒ⋯⋅⋅ze+Ggze,R∇=maxe∈1,mjΧz,ej,where mi is the overall number of units in the ith layer and j signifies the overall number of layers in MMN. Conventional activation functions that are nonlinear, such as the absolute value rectifier and ReLU are well approximated using MMN. Thus, feature fusion F is undergone by DMN training, from which the fractional coefficient is obtained based on the overlap coefficient that is indicated as(8)∂=Ocdr,χr,where ∂ is the fractional coefficient, Oc is the overlap coefficient, dr is the data record, and χr is the average of dr belonging to the class.After feature fusion, the size of features varies fromFo×b to Fo×k. The fused features are of sizes from BOT-IoT 100000×41 to NSL-KDD 100000×31. Figure 2 represents the architecture of DMN.Figure 2
Structural architecture of DMN.


### 4.3. Data Augmentation

Fused featuresF are augmented for increasing data diversity by excluding uneven balance of datasets. For eliminating imbalanced number of data, the dimensionality of the database is increased by the augmentation process. This data augmentation process is carried out using the oversampling technique. Here, the size of fused data with o×b is incremented to o×q. For example, if the size of data after fusion is 10×5, then the size of data after augmentation is 10,000×5 that generates 99,990 samples based on the oversampling method. Here, the augmented data is indicated as Faug with size o×q. The augmented data are with sizes of 1000000×41 from the BOT-IoT dataset and 1000000×31 from the NSL-KDD dataset.


### 4.4. DDOS Attack Detection

After the process of data augmentation, the augmented data is fed to the next process of attack detection, where the DDoS attack is detected by DSA [19] that is trained by the proposed GHLBO. The architecture of DSA followed and the training procedure carried out is explained below.


#### 4.4.1. Architecture of the Deep Stacked Autoencoder

An auto encoder [19] is an unsupervised learning configuration-based type, where three layers such as hidden, input, and output layers are present. The input fed to DSA is Faug. Here, the training process is carried out by two sections such as the encoder and decoder. An encoder utilizes input data mapping to convert into the hidden illustration and a decoder reconstructs input data from the derived hidden illustration. For the presented unlabeled input data, l∆∆=1D, where l∆∈QI×J, α∆ indicates the vector of the hidden encoder taken from β∆ and the vector of the output layer decoder is represented by l∆∧. Thus, the encoding process is formulated by(9)β∆=αΕ1l∆+Η1,where the function of encoding is indicated by α, the matrix of encoder weight is Ε1, and Η1 is the bias vector. The decoder process is stated by(10)l∧∆=PΕ2β∆+Η2,where the function of decoding is represented using P, the weight matrix of the decoder is Ε2, and the bias vector is given as Η2.For minimization of the reconstruction error, an autoencoder parameter set is optimized as(11)εΟ=argminφ,φ′1∆∑r=1∆Ml∧,lr∧,where M is the loss function Ml,l∧=l−l∧2.Hence, SAE is carried out using three steps. First, the input data trains an autoencoder and thus attains the learned feature vector. Second, input for the following layer is taken as the previous layer’s feature vector and this iteration is continued until training completion. Finally, hidden layer training is carried out and the backpropagation method is used for minimization of the cost function and weights are updated by the labelled tuning group for obtaining best training. Hence, output obtained from DSA isZd. Figure 3 exhibits structural architecture of DSA with 90% of training data.Figure 3
Structural architecture of DSA.


#### 4.4.2. Training of DSA Using Developed GHLBO

Training of DSA [19] is carried out by the developed GHLBO algorithm for the detection of DDoS attacks. GHLBO is formed by integration of the gradient descent [20] and HLBO algorithm [21]. Gradient descent is one of the most famous algorithms that perform optimization of neural networks. Various behaviours of algorithms tend to optimize this gradient descent for brief summarization to resolve challenges in those algorithms. HLBO is an optimization algorithm introduced to guide population under hybrid leader guidance where this leader is generated depending on three members, such as one random member, the next corresponding member, and the last best member. HLBO is followed by two stages, namely, exploitation and exploration. Here, each member in population is a searcher to solve issues corresponding to the space search and hence the global search forms the main criterion in HLBO. The feature of gradient descent for exaggerating the optimization features of algorithms tends HLBO to more prominently improve its performance for enhancing the detection rate of DDoS attacks using newly developed and integrated GHLBO. The procedure regarding attack detection is given as follows.(1) Initialization. In HLBO, every member in population is a searcher in threat eradicating space, and hence, all followers in population are able to enhance their own position for finding the best solution. The updating process of population is carried out based on the best member and worst member prevent algorithm from the global search in the problem eradicating space. Consider HLBO population modelled in the matrix form as(12)L=L1⋮Lu⋮LYY×v=l11⋯l1y⋯l1v⋮⋱⋮⋱⋮lu1⋯luy⋯luv⋮⋱⋮⋱⋮lY1⋯lYy⋯lYvY×v,where the HLBO algorithm is denoted as L, Lu is the uth candidate solution, luy is the yth variable determined by the uth candidate solution, Y is the HLBO population size, and v is the count of problem variables.(2) Fitness Computation. Better optimal solution is generated by computing the fitness factor and is expressed as(13)Fitness=1κ∑ϖ=1κDo−Zd,where Do is the output aimed, the DSA output result is represented by Zd, κ is the number of training samples taken for the training process, and ϖ is the number of processed samples.(3) Exploration Stage. Exploration is a feature, enabling members of the population to scan various sources of the search space for finding the original optimal area. The best member in the population reduces time for exploration of the search space; however, the hybrid leader tends to update the position of members in the population. In constructing the random leader, three populations, such as random, corresponding, and best members are considered. Quality of each population member is represented as(14)wu=Tu−Tworst∑y=1YTy−Tworst,u∈1,2,⋯,Y.Participation coefficients of each member are expressed based on equation (14) as(15)WVu=wuwu+wbest+wϑ,(16)WVbest=wbestwu+wbest+wϑ,(17)WVϑ=wϑwu+wbest+wϑ,where u,ϑ∈1,2,…,Y,ϑ≠u,wu is the quality of theuth candidate solution, wbest is the objective function of the best solution, and Tworst is the objective worst candidate function’s solution. At each repetition, the hybrid leader is created for each member of the population that is represented as(18)ΜXu=WVu.Lu+WVbest.Lbest+WVϑ.Lϑ,where ΜXu is the hybrid leader for the uth member and Lϑ is the population member selected randomly.(4) Updating Position. The position is updated by the hybrid leader for the optimal search space and this update position is only accepted when the objective function value is improved from the previous position. This update condition is expressed as(19)lu,yS+1=lu,yS+U.ΜXu,y+Ζ.lu,y,whenTΜXu<Tu,(20)lu,yS+1=lu,yS+U.ΜXu,y+U.Ζ.lu,y,(21)lu,yS+1=lu,yS1+U.Ζ+U.ΜXu,y,where lu,yS+1 is the position of the uth solution in the yth dimension at the iteration S+1, U is a randomly formed real number from the interval (0, 1), then Ζ is an integer randomly selected with the set 1,2, and ΜXu,y indicates the hybrid leader of the uth solution.(5) Updating Parameter for the Training Sample. Gradient descent updates a parameter to every training data for improving its performance and is formulated as(22)lu,yS+1=lu,yS-ℏlflu,yS,(23)lu,yS=ℏlflu,yS+lu,yS+1.By substituting equation (23) in equation (21),(24)lu,yS+1=ℏlflu,yS+lu,yS+11+U.Ζ+U.ΜXu,y,(25)lu,yS+1−lu,yS+11+U.Ζ=ℏlflu,yS1+U.Ζ+U.ΜXu,y,(26)lu,yS+11−1−U.Ζ=ℏlflu,yS1+U.Ζ+U.ΜXu,y,(27)lu,yS+1=1−U.Ζℏlflu,yS1+U.Ζ+U.ΜXu,y,(28)lu,yS+1=1U.Ζℏlflu,yS−1−U.Ζ−U.ΜXu,y,where the position of the yth dimension in the uth solution is lu,yS+1, iteration is S+1, the randomly created real number is U from the interval (0, 1), the integer that is randomly selected is Ζ within the set 1,2, the hybrid leader of the uth solution is ΜXu,y, and ℏ is a parameter, which scales the gradient.(6) Exploitation Stage. Ability to make the algorithm population enable for searching locally is termed as the exploitation phase. This brings out the best solution nearby obtained solutions. This is created by the neighbourhood member around each and every member of the population that makes the particular member to change the position and supports to find the best value for the objective-based function. Equation for exploration which is expressed as(29)lu,yS+1=lu,yS+1−2U.ζ1−SR.lu,y,(30)Lu=LuS+1,TuS+1<Tu,Luelse,where ζ is the constant value equal to 0.2, LuS+1 is the newly formed position of the uth member, lu,yS+1 is its jth dimension, TuS+1 is the objective function depending on the exploitation phase, S denotes the iteration counter, and R is maximum iteration numbers.(7) Repetition. The iteration process is continued by implementing exploration and exploitation phases. The algorithm follows the next iteration stage and the process is updated and continued based on the exploration and exploitation phases. Finally, the best member solution is formed as the solution to issue.(8) End. Till obtaining the proper optimal solution, the process gets repeated to find DDoS detection on an attack in cloud computing. Table 2 predicts explanative pseudocode of the GHLBO algorithm.Table 2
Proposed GHLBO’s pseudocode.
Initiate GHLBOInput:lAdjustY and RStart with member position and evaluating objective functionForu = 1 to YForS = 1 to RComputation of fitness using equation (13)Stage 1: explorationCalculation of quality by equation (14)Calculation of participation coefficients by equations (15)–(17)Creating hybrid leader by equation (18)Calculating new position ofuth member by equation (19)Updating gradient parameter for training sample by equation (22)New position ofuth solution in yth dimension is obtained by equation (28)Stage 2: explorationCalculation of novel position ofuth member using equation (29)Updatinguth member by equation (30)End if;Recalculating best optimal solution using equation (13)ConcludedOutcome: best member solution is generatedEnd GHLBOHence, the developed GHLBO-based DSA is very efficient in DDoS attack detection in cloud computing to find whether attacked or not.


## 4.1. Log File Creation

The initial phase of designed DDoS detection on attacks is creating a log file that is indicated asA. Users of the cloud system access to the model of cloud via the allocator or resource scheduler. The resource allocation model consists of data regarding free devices that allocates the device to a user based on their necessities. The resource scheduler identifies every information on the log file of each user to generate A. Abrupt information is available in the log file that is unable to be directly utilized for training [2]. The log file contains the IP address and its log information that is considered as features. The original data size obtained from datasets like BOT-IoT is in the size of 100000×48 and NSL-KDD is of 10000×42. The representation of the log file with features is given as(1)A=f1,f2,…,fn,where f1 and f2 represent the features in the log file and n represents the complete account of features.


## 4.2. Feature Fusion Based on DMN with the Overlap Coefficient

After the construction ofA, the next step is feature fusion based on DMN [18] with the overlap coefficient. Features that are taken from the log file are fused before the detection of DDoS as this may lead to identification of attack easily.


### 4.2.1. Arranging Features Based on Overlap Coefficient

Features are to be arranged based on the relativeness of their closeness character for making data in the readable format and for optimizing the rate of detection. The arrangement of features is carried out by the overlap coefficient that arranges features based on their measured closeness features. The overlap coefficient is represented as(2)Ocf1,f3=f1∩f3minf1f3,where f1 and f3 represent features with the same closeness character.


### 4.2.2. Fusion

After the arrangement of features according to the same measured closeness, they are fused so that independent features are converted to a unique feature in order to process easily. Fusion formula is expressed as(3)F=∑a=1b∂dpa,where F denotes the fusion of features expressed in the vector form, b is the maximum feature range, and d indicates the full feature account. Furthermore, the generation of F is carried out based on the following formula for a as(4)a=b−Kd,where d is the first obtained based on K and t, which is formulated as(5)d=Kt;1≤s≤t,where K is for full amount of features and t indicates the features selected. Here, the feature size is changed to Fo×k from the initial size Fo×b.


### 4.2.3. Generating∂ Using the Deep Maxout Network

The fractional coefficient∂ is generated for finding the feature fusion depending on the overlap coefficient and data records. DMN is trained to find the fractional coefficient and the architecture of DMN is explained as follows:(1) Architecture of DMN.DMN [18] is one of the neural network’s types, which has many numbers of layers that create hidden activations via the maxout function. Here, functions on activation are exemplified by the nth layer, where hidden units are characterized to various disjunct groups. In DMN, the activation function is replaced by MMN weights and maxout units. Maxout is a common category of ReLU which achieves the maximum operation on altered linear representations. The maxout unit-based result [22] is formulated as(6)CzE∇=maxe∈1,mIze,where Ize=E∇ΑΒ....ze+GGze is the parameter that is trained and m is the total number of units of subhidden linear terms.Feature maps are formed by layering conv filters along the MMNs activation function above the local patch, and this is fed into further higher layers. Here, every hidden neuron is the maxout unit, which is denoted as multilayer generalization guarding maxout behavior, while improving construction capability of various distributions of latent ideas. This MMN is a kind of a activation function for training. Assuming input asE∇, which is the hidden layer raw input vector, activation function is expressed as follows:(7)Χz,e1=maxe∈1,m1E∇ΑΒ⋯⋅⋅ze+Ggze,Χz,e2=maxe∈1,m2Χz,e1ΑΒ⋯⋅⋅ze+Ggze,Χz,eh=maxe∈1,miHz,ei−1ΑΒ⋯⋅⋅ze+Ggze,Χz,ej=maxe∈1,mjΧz,ej−1ΑΒ⋯⋅⋅ze+Ggze,R∇=maxe∈1,mjΧz,ej,where mi is the overall number of units in the ith layer and j signifies the overall number of layers in MMN. Conventional activation functions that are nonlinear, such as the absolute value rectifier and ReLU are well approximated using MMN. Thus, feature fusion F is undergone by DMN training, from which the fractional coefficient is obtained based on the overlap coefficient that is indicated as(8)∂=Ocdr,χr,where ∂ is the fractional coefficient, Oc is the overlap coefficient, dr is the data record, and χr is the average of dr belonging to the class.After feature fusion, the size of features varies fromFo×b to Fo×k. The fused features are of sizes from BOT-IoT 100000×41 to NSL-KDD 100000×31. Figure 2 represents the architecture of DMN.Figure 2
Structural architecture of DMN.


## 4.2.1. Arranging Features Based on Overlap Coefficient

Features are to be arranged based on the relativeness of their closeness character for making data in the readable format and for optimizing the rate of detection. The arrangement of features is carried out by the overlap coefficient that arranges features based on their measured closeness features. The overlap coefficient is represented as(2)Ocf1,f3=f1∩f3minf1f3,where f1 and f3 represent features with the same closeness character.


## 4.2.2. Fusion

After the arrangement of features according to the same measured closeness, they are fused so that independent features are converted to a unique feature in order to process easily. Fusion formula is expressed as(3)F=∑a=1b∂dpa,where F denotes the fusion of features expressed in the vector form, b is the maximum feature range, and d indicates the full feature account. Furthermore, the generation of F is carried out based on the following formula for a as(4)a=b−Kd,where d is the first obtained based on K and t, which is formulated as(5)d=Kt;1≤s≤t,where K is for full amount of features and t indicates the features selected. Here, the feature size is changed to Fo×k from the initial size Fo×b.


## 4.2.3. Generating∂ Using the Deep Maxout Network

The fractional coefficient∂ is generated for finding the feature fusion depending on the overlap coefficient and data records. DMN is trained to find the fractional coefficient and the architecture of DMN is explained as follows:(1) Architecture of DMN.DMN [18] is one of the neural network’s types, which has many numbers of layers that create hidden activations via the maxout function. Here, functions on activation are exemplified by the nth layer, where hidden units are characterized to various disjunct groups. In DMN, the activation function is replaced by MMN weights and maxout units. Maxout is a common category of ReLU which achieves the maximum operation on altered linear representations. The maxout unit-based result [22] is formulated as(6)CzE∇=maxe∈1,mIze,where Ize=E∇ΑΒ....ze+GGze is the parameter that is trained and m is the total number of units of subhidden linear terms.Feature maps are formed by layering conv filters along the MMNs activation function above the local patch, and this is fed into further higher layers. Here, every hidden neuron is the maxout unit, which is denoted as multilayer generalization guarding maxout behavior, while improving construction capability of various distributions of latent ideas. This MMN is a kind of a activation function for training. Assuming input asE∇, which is the hidden layer raw input vector, activation function is expressed as follows:(7)Χz,e1=maxe∈1,m1E∇ΑΒ⋯⋅⋅ze+Ggze,Χz,e2=maxe∈1,m2Χz,e1ΑΒ⋯⋅⋅ze+Ggze,Χz,eh=maxe∈1,miHz,ei−1ΑΒ⋯⋅⋅ze+Ggze,Χz,ej=maxe∈1,mjΧz,ej−1ΑΒ⋯⋅⋅ze+Ggze,R∇=maxe∈1,mjΧz,ej,where mi is the overall number of units in the ith layer and j signifies the overall number of layers in MMN. Conventional activation functions that are nonlinear, such as the absolute value rectifier and ReLU are well approximated using MMN. Thus, feature fusion F is undergone by DMN training, from which the fractional coefficient is obtained based on the overlap coefficient that is indicated as(8)∂=Ocdr,χr,where ∂ is the fractional coefficient, Oc is the overlap coefficient, dr is the data record, and χr is the average of dr belonging to the class.After feature fusion, the size of features varies fromFo×b to Fo×k. The fused features are of sizes from BOT-IoT 100000×41 to NSL-KDD 100000×31. Figure 2 represents the architecture of DMN.Figure 2
Structural architecture of DMN.


## 4.3. Data Augmentation

Fused featuresF are augmented for increasing data diversity by excluding uneven balance of datasets. For eliminating imbalanced number of data, the dimensionality of the database is increased by the augmentation process. This data augmentation process is carried out using the oversampling technique. Here, the size of fused data with o×b is incremented to o×q. For example, if the size of data after fusion is 10×5, then the size of data after augmentation is 10,000×5 that generates 99,990 samples based on the oversampling method. Here, the augmented data is indicated as Faug with size o×q. The augmented data are with sizes of 1000000×41 from the BOT-IoT dataset and 1000000×31 from the NSL-KDD dataset.


## 4.4. DDOS Attack Detection

After the process of data augmentation, the augmented data is fed to the next process of attack detection, where the DDoS attack is detected by DSA [19] that is trained by the proposed GHLBO. The architecture of DSA followed and the training procedure carried out is explained below.


### 4.4.1. Architecture of the Deep Stacked Autoencoder

An auto encoder [19] is an unsupervised learning configuration-based type, where three layers such as hidden, input, and output layers are present. The input fed to DSA is Faug. Here, the training process is carried out by two sections such as the encoder and decoder. An encoder utilizes input data mapping to convert into the hidden illustration and a decoder reconstructs input data from the derived hidden illustration. For the presented unlabeled input data, l∆∆=1D, where l∆∈QI×J, α∆ indicates the vector of the hidden encoder taken from β∆ and the vector of the output layer decoder is represented by l∆∧. Thus, the encoding process is formulated by(9)β∆=αΕ1l∆+Η1,where the function of encoding is indicated by α, the matrix of encoder weight is Ε1, and Η1 is the bias vector. The decoder process is stated by(10)l∧∆=PΕ2β∆+Η2,where the function of decoding is represented using P, the weight matrix of the decoder is Ε2, and the bias vector is given as Η2.For minimization of the reconstruction error, an autoencoder parameter set is optimized as(11)εΟ=argminφ,φ′1∆∑r=1∆Ml∧,lr∧,where M is the loss function Ml,l∧=l−l∧2.Hence, SAE is carried out using three steps. First, the input data trains an autoencoder and thus attains the learned feature vector. Second, input for the following layer is taken as the previous layer’s feature vector and this iteration is continued until training completion. Finally, hidden layer training is carried out and the backpropagation method is used for minimization of the cost function and weights are updated by the labelled tuning group for obtaining best training. Hence, output obtained from DSA isZd. Figure 3 exhibits structural architecture of DSA with 90% of training data.Figure 3
Structural architecture of DSA.


### 4.4.2. Training of DSA Using Developed GHLBO

Training of DSA [19] is carried out by the developed GHLBO algorithm for the detection of DDoS attacks. GHLBO is formed by integration of the gradient descent [20] and HLBO algorithm [21]. Gradient descent is one of the most famous algorithms that perform optimization of neural networks. Various behaviours of algorithms tend to optimize this gradient descent for brief summarization to resolve challenges in those algorithms. HLBO is an optimization algorithm introduced to guide population under hybrid leader guidance where this leader is generated depending on three members, such as one random member, the next corresponding member, and the last best member. HLBO is followed by two stages, namely, exploitation and exploration. Here, each member in population is a searcher to solve issues corresponding to the space search and hence the global search forms the main criterion in HLBO. The feature of gradient descent for exaggerating the optimization features of algorithms tends HLBO to more prominently improve its performance for enhancing the detection rate of DDoS attacks using newly developed and integrated GHLBO. The procedure regarding attack detection is given as follows.(1) Initialization. In HLBO, every member in population is a searcher in threat eradicating space, and hence, all followers in population are able to enhance their own position for finding the best solution. The updating process of population is carried out based on the best member and worst member prevent algorithm from the global search in the problem eradicating space. Consider HLBO population modelled in the matrix form as(12)L=L1⋮Lu⋮LYY×v=l11⋯l1y⋯l1v⋮⋱⋮⋱⋮lu1⋯luy⋯luv⋮⋱⋮⋱⋮lY1⋯lYy⋯lYvY×v,where the HLBO algorithm is denoted as L, Lu is the uth candidate solution, luy is the yth variable determined by the uth candidate solution, Y is the HLBO population size, and v is the count of problem variables.(2) Fitness Computation. Better optimal solution is generated by computing the fitness factor and is expressed as(13)Fitness=1κ∑ϖ=1κDo−Zd,where Do is the output aimed, the DSA output result is represented by Zd, κ is the number of training samples taken for the training process, and ϖ is the number of processed samples.(3) Exploration Stage. Exploration is a feature, enabling members of the population to scan various sources of the search space for finding the original optimal area. The best member in the population reduces time for exploration of the search space; however, the hybrid leader tends to update the position of members in the population. In constructing the random leader, three populations, such as random, corresponding, and best members are considered. Quality of each population member is represented as(14)wu=Tu−Tworst∑y=1YTy−Tworst,u∈1,2,⋯,Y.Participation coefficients of each member are expressed based on equation (14) as(15)WVu=wuwu+wbest+wϑ,(16)WVbest=wbestwu+wbest+wϑ,(17)WVϑ=wϑwu+wbest+wϑ,where u,ϑ∈1,2,…,Y,ϑ≠u,wu is the quality of theuth candidate solution, wbest is the objective function of the best solution, and Tworst is the objective worst candidate function’s solution. At each repetition, the hybrid leader is created for each member of the population that is represented as(18)ΜXu=WVu.Lu+WVbest.Lbest+WVϑ.Lϑ,where ΜXu is the hybrid leader for the uth member and Lϑ is the population member selected randomly.(4) Updating Position. The position is updated by the hybrid leader for the optimal search space and this update position is only accepted when the objective function value is improved from the previous position. This update condition is expressed as(19)lu,yS+1=lu,yS+U.ΜXu,y+Ζ.lu,y,whenTΜXu<Tu,(20)lu,yS+1=lu,yS+U.ΜXu,y+U.Ζ.lu,y,(21)lu,yS+1=lu,yS1+U.Ζ+U.ΜXu,y,where lu,yS+1 is the position of the uth solution in the yth dimension at the iteration S+1, U is a randomly formed real number from the interval (0, 1), then Ζ is an integer randomly selected with the set 1,2, and ΜXu,y indicates the hybrid leader of the uth solution.(5) Updating Parameter for the Training Sample. Gradient descent updates a parameter to every training data for improving its performance and is formulated as(22)lu,yS+1=lu,yS-ℏlflu,yS,(23)lu,yS=ℏlflu,yS+lu,yS+1.By substituting equation (23) in equation (21),(24)lu,yS+1=ℏlflu,yS+lu,yS+11+U.Ζ+U.ΜXu,y,(25)lu,yS+1−lu,yS+11+U.Ζ=ℏlflu,yS1+U.Ζ+U.ΜXu,y,(26)lu,yS+11−1−U.Ζ=ℏlflu,yS1+U.Ζ+U.ΜXu,y,(27)lu,yS+1=1−U.Ζℏlflu,yS1+U.Ζ+U.ΜXu,y,(28)lu,yS+1=1U.Ζℏlflu,yS−1−U.Ζ−U.ΜXu,y,where the position of the yth dimension in the uth solution is lu,yS+1, iteration is S+1, the randomly created real number is U from the interval (0, 1), the integer that is randomly selected is Ζ within the set 1,2, the hybrid leader of the uth solution is ΜXu,y, and ℏ is a parameter, which scales the gradient.(6) Exploitation Stage. Ability to make the algorithm population enable for searching locally is termed as the exploitation phase. This brings out the best solution nearby obtained solutions. This is created by the neighbourhood member around each and every member of the population that makes the particular member to change the position and supports to find the best value for the objective-based function. Equation for exploration which is expressed as(29)lu,yS+1=lu,yS+1−2U.ζ1−SR.lu,y,(30)Lu=LuS+1,TuS+1<Tu,Luelse,where ζ is the constant value equal to 0.2, LuS+1 is the newly formed position of the uth member, lu,yS+1 is its jth dimension, TuS+1 is the objective function depending on the exploitation phase, S denotes the iteration counter, and R is maximum iteration numbers.(7) Repetition. The iteration process is continued by implementing exploration and exploitation phases. The algorithm follows the next iteration stage and the process is updated and continued based on the exploration and exploitation phases. Finally, the best member solution is formed as the solution to issue.(8) End. Till obtaining the proper optimal solution, the process gets repeated to find DDoS detection on an attack in cloud computing. Table 2 predicts explanative pseudocode of the GHLBO algorithm.Table 2
Proposed GHLBO’s pseudocode.
Initiate GHLBOInput:lAdjustY and RStart with member position and evaluating objective functionForu = 1 to YForS = 1 to RComputation of fitness using equation (13)Stage 1: explorationCalculation of quality by equation (14)Calculation of participation coefficients by equations (15)–(17)Creating hybrid leader by equation (18)Calculating new position ofuth member by equation (19)Updating gradient parameter for training sample by equation (22)New position ofuth solution in yth dimension is obtained by equation (28)Stage 2: explorationCalculation of novel position ofuth member using equation (29)Updatinguth member by equation (30)End if;Recalculating best optimal solution using equation (13)ConcludedOutcome: best member solution is generatedEnd GHLBOHence, the developed GHLBO-based DSA is very efficient in DDoS attack detection in cloud computing to find whether attacked or not.


## 4.4.1. Architecture of the Deep Stacked Autoencoder

An auto encoder [19] is an unsupervised learning configuration-based type, where three layers such as hidden, input, and output layers are present. The input fed to DSA is Faug. Here, the training process is carried out by two sections such as the encoder and decoder. An encoder utilizes input data mapping to convert into the hidden illustration and a decoder reconstructs input data from the derived hidden illustration. For the presented unlabeled input data, l∆∆=1D, where l∆∈QI×J, α∆ indicates the vector of the hidden encoder taken from β∆ and the vector of the output layer decoder is represented by l∆∧. Thus, the encoding process is formulated by(9)β∆=αΕ1l∆+Η1,where the function of encoding is indicated by α, the matrix of encoder weight is Ε1, and Η1 is the bias vector. The decoder process is stated by(10)l∧∆=PΕ2β∆+Η2,where the function of decoding is represented using P, the weight matrix of the decoder is Ε2, and the bias vector is given as Η2.For minimization of the reconstruction error, an autoencoder parameter set is optimized as(11)εΟ=argminφ,φ′1∆∑r=1∆Ml∧,lr∧,where M is the loss function Ml,l∧=l−l∧2.Hence, SAE is carried out using three steps. First, the input data trains an autoencoder and thus attains the learned feature vector. Second, input for the following layer is taken as the previous layer’s feature vector and this iteration is continued until training completion. Finally, hidden layer training is carried out and the backpropagation method is used for minimization of the cost function and weights are updated by the labelled tuning group for obtaining best training. Hence, output obtained from DSA isZd. Figure 3 exhibits structural architecture of DSA with 90% of training data.Figure 3
Structural architecture of DSA.


## 4.4.2. Training of DSA Using Developed GHLBO

Training of DSA [19] is carried out by the developed GHLBO algorithm for the detection of DDoS attacks. GHLBO is formed by integration of the gradient descent [20] and HLBO algorithm [21]. Gradient descent is one of the most famous algorithms that perform optimization of neural networks. Various behaviours of algorithms tend to optimize this gradient descent for brief summarization to resolve challenges in those algorithms. HLBO is an optimization algorithm introduced to guide population under hybrid leader guidance where this leader is generated depending on three members, such as one random member, the next corresponding member, and the last best member. HLBO is followed by two stages, namely, exploitation and exploration. Here, each member in population is a searcher to solve issues corresponding to the space search and hence the global search forms the main criterion in HLBO. The feature of gradient descent for exaggerating the optimization features of algorithms tends HLBO to more prominently improve its performance for enhancing the detection rate of DDoS attacks using newly developed and integrated GHLBO. The procedure regarding attack detection is given as follows.(1) Initialization. In HLBO, every member in population is a searcher in threat eradicating space, and hence, all followers in population are able to enhance their own position for finding the best solution. The updating process of population is carried out based on the best member and worst member prevent algorithm from the global search in the problem eradicating space. Consider HLBO population modelled in the matrix form as(12)L=L1⋮Lu⋮LYY×v=l11⋯l1y⋯l1v⋮⋱⋮⋱⋮lu1⋯luy⋯luv⋮⋱⋮⋱⋮lY1⋯lYy⋯lYvY×v,where the HLBO algorithm is denoted as L, Lu is the uth candidate solution, luy is the yth variable determined by the uth candidate solution, Y is the HLBO population size, and v is the count of problem variables.(2) Fitness Computation. Better optimal solution is generated by computing the fitness factor and is expressed as(13)Fitness=1κ∑ϖ=1κDo−Zd,where Do is the output aimed, the DSA output result is represented by Zd, κ is the number of training samples taken for the training process, and ϖ is the number of processed samples.(3) Exploration Stage. Exploration is a feature, enabling members of the population to scan various sources of the search space for finding the original optimal area. The best member in the population reduces time for exploration of the search space; however, the hybrid leader tends to update the position of members in the population. In constructing the random leader, three populations, such as random, corresponding, and best members are considered. Quality of each population member is represented as(14)wu=Tu−Tworst∑y=1YTy−Tworst,u∈1,2,⋯,Y.Participation coefficients of each member are expressed based on equation (14) as(15)WVu=wuwu+wbest+wϑ,(16)WVbest=wbestwu+wbest+wϑ,(17)WVϑ=wϑwu+wbest+wϑ,where u,ϑ∈1,2,…,Y,ϑ≠u,wu is the quality of theuth candidate solution, wbest is the objective function of the best solution, and Tworst is the objective worst candidate function’s solution. At each repetition, the hybrid leader is created for each member of the population that is represented as(18)ΜXu=WVu.Lu+WVbest.Lbest+WVϑ.Lϑ,where ΜXu is the hybrid leader for the uth member and Lϑ is the population member selected randomly.(4) Updating Position. The position is updated by the hybrid leader for the optimal search space and this update position is only accepted when the objective function value is improved from the previous position. This update condition is expressed as(19)lu,yS+1=lu,yS+U.ΜXu,y+Ζ.lu,y,whenTΜXu<Tu,(20)lu,yS+1=lu,yS+U.ΜXu,y+U.Ζ.lu,y,(21)lu,yS+1=lu,yS1+U.Ζ+U.ΜXu,y,where lu,yS+1 is the position of the uth solution in the yth dimension at the iteration S+1, U is a randomly formed real number from the interval (0, 1), then Ζ is an integer randomly selected with the set 1,2, and ΜXu,y indicates the hybrid leader of the uth solution.(5) Updating Parameter for the Training Sample. Gradient descent updates a parameter to every training data for improving its performance and is formulated as(22)lu,yS+1=lu,yS-ℏlflu,yS,(23)lu,yS=ℏlflu,yS+lu,yS+1.By substituting equation (23) in equation (21),(24)lu,yS+1=ℏlflu,yS+lu,yS+11+U.Ζ+U.ΜXu,y,(25)lu,yS+1−lu,yS+11+U.Ζ=ℏlflu,yS1+U.Ζ+U.ΜXu,y,(26)lu,yS+11−1−U.Ζ=ℏlflu,yS1+U.Ζ+U.ΜXu,y,(27)lu,yS+1=1−U.Ζℏlflu,yS1+U.Ζ+U.ΜXu,y,(28)lu,yS+1=1U.Ζℏlflu,yS−1−U.Ζ−U.ΜXu,y,where the position of the yth dimension in the uth solution is lu,yS+1, iteration is S+1, the randomly created real number is U from the interval (0, 1), the integer that is randomly selected is Ζ within the set 1,2, the hybrid leader of the uth solution is ΜXu,y, and ℏ is a parameter, which scales the gradient.(6) Exploitation Stage. Ability to make the algorithm population enable for searching locally is termed as the exploitation phase. This brings out the best solution nearby obtained solutions. This is created by the neighbourhood member around each and every member of the population that makes the particular member to change the position and supports to find the best value for the objective-based function. Equation for exploration which is expressed as(29)lu,yS+1=lu,yS+1−2U.ζ1−SR.lu,y,(30)Lu=LuS+1,TuS+1<Tu,Luelse,where ζ is the constant value equal to 0.2, LuS+1 is the newly formed position of the uth member, lu,yS+1 is its jth dimension, TuS+1 is the objective function depending on the exploitation phase, S denotes the iteration counter, and R is maximum iteration numbers.(7) Repetition. The iteration process is continued by implementing exploration and exploitation phases. The algorithm follows the next iteration stage and the process is updated and continued based on the exploration and exploitation phases. Finally, the best member solution is formed as the solution to issue.(8) End. Till obtaining the proper optimal solution, the process gets repeated to find DDoS detection on an attack in cloud computing. Table 2 predicts explanative pseudocode of the GHLBO algorithm.Table 2
Proposed GHLBO’s pseudocode.
Initiate GHLBOInput:lAdjustY and RStart with member position and evaluating objective functionForu = 1 to YForS = 1 to RComputation of fitness using equation (13)Stage 1: explorationCalculation of quality by equation (14)Calculation of participation coefficients by equations (15)–(17)Creating hybrid leader by equation (18)Calculating new position ofuth member by equation (19)Updating gradient parameter for training sample by equation (22)New position ofuth solution in yth dimension is obtained by equation (28)Stage 2: explorationCalculation of novel position ofuth member using equation (29)Updatinguth member by equation (30)End if;Recalculating best optimal solution using equation (13)ConcludedOutcome: best member solution is generatedEnd GHLBOHence, the developed GHLBO-based DSA is very efficient in DDoS attack detection in cloud computing to find whether attacked or not.


## 5. Discussion with Results

Results regarding DDoS attack detection depending on evaluation metrics are deliberated in this section.


### 5.1. Experimental Assessment

The developed model is setup in the MATLAB tool in a PC with the Intel i3 core processor, along with Windows 10 OS and 2 GB RAM.


### 5.2. Dataset Description

Input data for the processing of DDoS attack detection is taken from a dataset [23, 24] that has various data corresponding to attack detection.


#### 5.2.1. NSL-KDD

NSL-KDD is updated sort of KDD cup99 that forms an efficient benchmark for researchers to compare various types of the IDS dataset. They provide 21 predicated labels with fifty thousand information. They have superfluous records in the train set with best detection rates on all frequently used records. Simultaneously, evaluation results of various research works are provided, that is, consistent and comparable.


#### 5.2.2. BOT-IoT

The BoT-IoT dataset was generated to design accurate environment of the network in Cyber Range Lab of Center of UNSW Canberra Cyber. The source file is provided in various formats, such as csv files, original pcap files, and argus files. These files are parted, depending on the category and subcategory of attacks, to support the process of labelling. Captured pcap files are of 69.3 GB size, with more than 72,000,000 record files.


### 5.3. Assessing with Performance Metrics

Performance measures utilized in this developed model is TPR, TNR, and testing accuracy. Metrics used are described as follows:(a)
TPR: TPR determines the proportion of the DDoS attack that is identified appropriately from the original file. It is indicated by using the following formula:(31)TPR=tprtpr+fnr.(b)
TNR: this gives ratio of authentic data identified approximately from the overall number of data that is classified as true or reliable and is presented as(32)TNR=tnrtnr+fpr.(c)
Testing accuracy: it is most important measure for finding effectiveness of the developed DDoS detection approach. This gives the overall proportion of correctly identified data either attack or normal from total count of data provided and is formulated as(33)Acc=tpr+tnrtpr+tnr+fpr+fnr.Here,tpr indicates the number of manipulated images that are found, tnr is the number of authentic data, fpr indicates the number of authentic data categorized as fake and fnr specifies the total forged data detected as reliable.


### 5.4. Algorithmic Assessment

The proposed GHLBO-enabled DSA is assessed algorithmically in comparison with various other optimization techniques, such as GA [25] enabled DSA, PSO algorithm [26] enabled DSA, CS algorithm [27] enabled DSA, and HLBO enabled DSA with varying learning data in percentage. Here, the DSA is training with other optimization algorithms, such as GA, PSO, the CS algorithm, and HLBO and the performance is compared with the proposed GHLBO.


#### 5.4.1. Algorithmic Analysis Based on BOT-IoT

BOT-IoT-based algorithmic analysis with varying percentages of learning data for various methods is discussed and represented in Figure4. For this analysis, the learning data varies from 50% to 90% and the maximum performance is attained at 90% of learning data. Testing accuracy based the algorithmic assessment for the BOT-IoT dataset is indicated in Figure 4(a). If learning data is 50%, the testing accuracy value is 0.798 for GA + DSA, 0.779 for PSO + DSA, 0.824 for CS + DSA, 0.878 for HLBO + DSA, and 0.896 for proposed GHLBO + DSA with performance improvement of 10.957%, 13.021%, 8.049%, and 1.961%. Figure 4(b) shows the TPR-based algorithmic analysis for the BOT-IoT dataset. Here, GA + DSA shows the TPR value of 0.794, PSO + DSA shows 0.828, CS + DSA gives the value of 0.848, HLBO + DSA gives 0.869, where the proposed method attains TPR of 0.879 when learning data is 60%. The performance improvement in the TPR value with the proposed model is 9.589%, 5.773%, 3.462%, and 0.990%. The TNR variation with algorithmic analysis from the BOT-IoT dataset is indicated in Figure 4(c). If learning data percentage is 70, TNR values are 0.786, 0.816, 0.783, 0.856, and 0.865 for GA + DSA, PSO + DSA, CS + DSA, HLBO + DSA, and proposed GHLBO + DSA. The improvement in performance values of TNR is 9.081%, 5.660%, 9.443%, and 0.990%.Figure 4
The algorithmic assessment based on BOT-IoT, (a) testing accuracy, (b) TPR, and (c) TNR.
(a)(b)(c)


#### 5.4.2. Algorithmic Analysis Based on NSL-KDD

The algorithmic assessment with change in the percentage of learning data from NSL-KDD is given in Figure5. Testing accuracy-based analysis for the algorithm is depicted in Figure 5(a). If learning data is 80%, then the testing accuracy value for the proposed model is 0.894, whereas other methods show lesser values of 0.726 for GA + DSA, 0.834 for PSO + DSA, 0.874 for CS + DSA, and 0.891 for HLBO + DSA. The value of testing accuracy is improved with the ranges of 18.789%, 6.689%, 2.171%, and 0.310%. The TPR-based algorithmic assessment for NSL-KDD is depicted in Figure 5(b). Here, when percentage of learning data = 90, TPR is 0.847 for GA + DSA and increases with values of 0.883, 0.887, 0.896, and 0.909 for PSO + DSA, CS + DSA, HLBO + DSA, and developed method. This shows improvement in performance with the proposed model with values of 6.803%, 2.905%, 2.509%, and 1.542%. Figure 5(c) gives the TNR variation of algorithmic analysis with respect to NSL-KDD. When learning data = 50%, the TNR value for the proposed method is 0.896, and it changes for PSO + DSA, GA + DSA, CS + DSA, and HLBO + DSA with values of 0.885, 0.873, 0.879, and 0.842, accordingly with performance improvement of 2.603%, 1.251%, 1.848%, and 5.982%.Figure 5
The algorithmic assessment based on NSL-KDD, (a) testing accuracy, (b) TPR, and (c) TNR.
(a)(b)(c)


### 5.5. Comparative Assessment

Developed model is compared with various methods, such as TEHO-DBN [28], LUCID [10], the ensemble approach [29], DNN [30], SD-LVQ [4], and FS-WOA [15] by changing learning data.


#### 5.5.1. Comparative Analysis Based on BOT-IoT

Figure6 depicts comparative assessment of various methods in terms of BOT-IoT. Testing accuracy based comparative analysis is indicated in Figure 6(a). When learning data percentage = 60, then values of testing accuracy are 0.788, 0.799, 0.833, 0.879, 0.883, 0.886, and 0.897 for TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, FS-WOA, and the proposed method. Improvement in performance with developed model for testing accuracy is 12.159%, 10.920%, 7.184%, 1.961%, 1.56%, and 1.23%. Figure 6(b) shows the TPR-based comparative assessment in terms of BOT-IoT. For, 70% learning data, values of TPR are 0.802, 0.829, 0.844, 0.883, 0.889, 0.892, and 0.901 for TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, FS-WOA, and the proposed method. This shows improvement in performance with 10.997%, 7.936%, 6.367%, 1.961%, 1.33%, and 1%. Figure 6(c) depicts TNR-based comparative analysis in terms of BOT-IoT. When learning data = 80%, TNR values of TEHO-DBN is 0.809, LUCID is 0.836, the ensemble approach is 0.841, DNN is 0.890, SD-LVQ is 0.902, FS-WOA is 0.903, and the proposed method is 0.908. Performance improvement with the developed model in terms of TNR is 10.915%, 7.889%, 7.367%, 1.961%, 0.66%, and 0.55%. The ROC analysis in terms of BOT-IoT is shown in Figure 6(d). When TPR = 3, FPR value of TEHO-DBN is 0.701, LUCID is 0.817, ensemble approach is 0.832, DNN is 0.833, SD-LVQ is 0.836, FS-WOA is 0.839, and the proposed method is 0.867.Figure 6
Comparative analysis in terms of BOT-IoT, (a) testing accuracy, (b) TPR, (c) TNR, and (d) ROC.
(a)(b)(c)(d)


#### 5.5.2. Comparative Analysis Based on NSL-KDD

Figure7 depicts the comparative assessment of many methods in terms of NSL-KDD. Testing accuracy based comparative performance is depicted in Figure 7(a). When learning data = 90%, then testing accuracy values are 0.828 for TEHO-DBN, 0.848 for LUCID, 0.878 for the ensemble approach, 0.896 for DNN, 0.898 for SD-LVQ, 0.908 for FS-WOA, and 0.914 for the proposed method. Improvement in performance with the developed model for testing accuracy is 9.378%, 7.167%, 3.851%, 1.961%, 1.75%, and 0.66%, respectively. Figure 7(b) shows the TPR-based comparative assessment in terms of NSL-KDD. For, 50% learning data, values of TPR are 0.799, 0.813, 0.834, 0.869, 0.872, 0.877, and 0.887 for TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, FS-WOA, and the proposed method. This shows improvement in performance with 9.895%, 8.416%, 5.954%, 1.961%, 1.69%, and 1.13%. Figure 7(c) depicts TNR-based comparative analysis in terms of NSL-KDD. When learning data = 60%, TNR values are TEHO-DBN = 0.782, LUCID = 0.771, the ensemble approach = 0.782, DNN = 0.841, SD-LVQ = 0.844, FS-WOA = 0.849, and the proposed method = 0.857. The performance improvement with the developed model in terms of TNR is 8.817%, 10.078%, 8.746%, 1.961%, 1.52%, and 0.93%. The ROC analysis in terms of NSL-KDD is shown in Figure 7(d). When TPR = 3, FPR values of TEHO-DBN is 0.880, LUCID is 0.876, the ensemble approach is 0.881, DNN is 0.853, SD-LVQ is 0.860, FS-WOA is 0.869, and the proposed method is 0.894.Figure 7
Comparative assessment based on NSL-KDD, (a) testing accuracy, (b) TPR, (c) TNR, and (d) ROC.
(a)(b)(c)(d)


### 5.6. Discussion with Comparison

Comparison is carried out for three evaluation metrics with respect to dual datasets, such as BOT-IoT and NSL-KDD for 90% learning data that is depicted in Table3. For 90% learning data, data taken from the BOT-IoT dataset shows the maximum testing accuracy value of 0.917, the TPR value of 0.908, and the maximum TNR value of 0.909. Hence, proposed GHLBO-enabled DSA is a very efficient method with high ranges of testing accuracy, TPR, and TNR, when compared with other existing methods.Table 3
Discussion with comparison of the proposed technique with existing techniques.
Classification typesMethods/metricsTEHO-DBNLUCIDEnsemble approachDNNSD-LVQFS-WOAProposed GHLBO-basedDSABOT-IoT with 90% learning dataTesting accuracy0.8240.8460.8730.8990.9020.9050.917TPR0.8190.8400.8660.8910.8960.9000.909TNR0.8310.8420.8600.8910.9030.9050.909NSL-KDD with 90% learning dataTesting accuracy0.8280.8480.8780.8960.8980.9080.914TPR0.8280.8480.8710.8910.8940.8990.909TNR0.8160.8270.8660.8830.8860.8920.901Bold values show higher performance compared to other methods.Table4 shows the computational analysis of the GHLBO-based DSA and TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, and FS-WOA. The minimum computational time of the GHLBO-based DSA is 2.676 sec.Table 4
Computational time analysis.
MethodsTEHO-DBNLUCIDEnsemble approachDNNSD-LVQFS-WOAProposed GHLBO-based DSAComputational time (sec)7.3256.8954.3663.6365.5324.3212.676Bold values show higher performance compared to other methods.


## 5.1. Experimental Assessment

The developed model is setup in the MATLAB tool in a PC with the Intel i3 core processor, along with Windows 10 OS and 2 GB RAM.


## 5.2. Dataset Description

Input data for the processing of DDoS attack detection is taken from a dataset [23, 24] that has various data corresponding to attack detection.


### 5.2.1. NSL-KDD

NSL-KDD is updated sort of KDD cup99 that forms an efficient benchmark for researchers to compare various types of the IDS dataset. They provide 21 predicated labels with fifty thousand information. They have superfluous records in the train set with best detection rates on all frequently used records. Simultaneously, evaluation results of various research works are provided, that is, consistent and comparable.


### 5.2.2. BOT-IoT

The BoT-IoT dataset was generated to design accurate environment of the network in Cyber Range Lab of Center of UNSW Canberra Cyber. The source file is provided in various formats, such as csv files, original pcap files, and argus files. These files are parted, depending on the category and subcategory of attacks, to support the process of labelling. Captured pcap files are of 69.3 GB size, with more than 72,000,000 record files.


## 5.2.1. NSL-KDD

NSL-KDD is updated sort of KDD cup99 that forms an efficient benchmark for researchers to compare various types of the IDS dataset. They provide 21 predicated labels with fifty thousand information. They have superfluous records in the train set with best detection rates on all frequently used records. Simultaneously, evaluation results of various research works are provided, that is, consistent and comparable.


## 5.2.2. BOT-IoT

The BoT-IoT dataset was generated to design accurate environment of the network in Cyber Range Lab of Center of UNSW Canberra Cyber. The source file is provided in various formats, such as csv files, original pcap files, and argus files. These files are parted, depending on the category and subcategory of attacks, to support the process of labelling. Captured pcap files are of 69.3 GB size, with more than 72,000,000 record files.


## 5.3. Assessing with Performance Metrics

Performance measures utilized in this developed model is TPR, TNR, and testing accuracy. Metrics used are described as follows:(a)
TPR: TPR determines the proportion of the DDoS attack that is identified appropriately from the original file. It is indicated by using the following formula:(31)TPR=tprtpr+fnr.(b)
TNR: this gives ratio of authentic data identified approximately from the overall number of data that is classified as true or reliable and is presented as(32)TNR=tnrtnr+fpr.(c)
Testing accuracy: it is most important measure for finding effectiveness of the developed DDoS detection approach. This gives the overall proportion of correctly identified data either attack or normal from total count of data provided and is formulated as(33)Acc=tpr+tnrtpr+tnr+fpr+fnr.Here,tpr indicates the number of manipulated images that are found, tnr is the number of authentic data, fpr indicates the number of authentic data categorized as fake and fnr specifies the total forged data detected as reliable.


## 5.4. Algorithmic Assessment

The proposed GHLBO-enabled DSA is assessed algorithmically in comparison with various other optimization techniques, such as GA [25] enabled DSA, PSO algorithm [26] enabled DSA, CS algorithm [27] enabled DSA, and HLBO enabled DSA with varying learning data in percentage. Here, the DSA is training with other optimization algorithms, such as GA, PSO, the CS algorithm, and HLBO and the performance is compared with the proposed GHLBO.


### 5.4.1. Algorithmic Analysis Based on BOT-IoT

BOT-IoT-based algorithmic analysis with varying percentages of learning data for various methods is discussed and represented in Figure4. For this analysis, the learning data varies from 50% to 90% and the maximum performance is attained at 90% of learning data. Testing accuracy based the algorithmic assessment for the BOT-IoT dataset is indicated in Figure 4(a). If learning data is 50%, the testing accuracy value is 0.798 for GA + DSA, 0.779 for PSO + DSA, 0.824 for CS + DSA, 0.878 for HLBO + DSA, and 0.896 for proposed GHLBO + DSA with performance improvement of 10.957%, 13.021%, 8.049%, and 1.961%. Figure 4(b) shows the TPR-based algorithmic analysis for the BOT-IoT dataset. Here, GA + DSA shows the TPR value of 0.794, PSO + DSA shows 0.828, CS + DSA gives the value of 0.848, HLBO + DSA gives 0.869, where the proposed method attains TPR of 0.879 when learning data is 60%. The performance improvement in the TPR value with the proposed model is 9.589%, 5.773%, 3.462%, and 0.990%. The TNR variation with algorithmic analysis from the BOT-IoT dataset is indicated in Figure 4(c). If learning data percentage is 70, TNR values are 0.786, 0.816, 0.783, 0.856, and 0.865 for GA + DSA, PSO + DSA, CS + DSA, HLBO + DSA, and proposed GHLBO + DSA. The improvement in performance values of TNR is 9.081%, 5.660%, 9.443%, and 0.990%.Figure 4
The algorithmic assessment based on BOT-IoT, (a) testing accuracy, (b) TPR, and (c) TNR.
(a)(b)(c)


### 5.4.2. Algorithmic Analysis Based on NSL-KDD

The algorithmic assessment with change in the percentage of learning data from NSL-KDD is given in Figure5. Testing accuracy-based analysis for the algorithm is depicted in Figure 5(a). If learning data is 80%, then the testing accuracy value for the proposed model is 0.894, whereas other methods show lesser values of 0.726 for GA + DSA, 0.834 for PSO + DSA, 0.874 for CS + DSA, and 0.891 for HLBO + DSA. The value of testing accuracy is improved with the ranges of 18.789%, 6.689%, 2.171%, and 0.310%. The TPR-based algorithmic assessment for NSL-KDD is depicted in Figure 5(b). Here, when percentage of learning data = 90, TPR is 0.847 for GA + DSA and increases with values of 0.883, 0.887, 0.896, and 0.909 for PSO + DSA, CS + DSA, HLBO + DSA, and developed method. This shows improvement in performance with the proposed model with values of 6.803%, 2.905%, 2.509%, and 1.542%. Figure 5(c) gives the TNR variation of algorithmic analysis with respect to NSL-KDD. When learning data = 50%, the TNR value for the proposed method is 0.896, and it changes for PSO + DSA, GA + DSA, CS + DSA, and HLBO + DSA with values of 0.885, 0.873, 0.879, and 0.842, accordingly with performance improvement of 2.603%, 1.251%, 1.848%, and 5.982%.Figure 5
The algorithmic assessment based on NSL-KDD, (a) testing accuracy, (b) TPR, and (c) TNR.
(a)(b)(c)


## 5.4.1. Algorithmic Analysis Based on BOT-IoT

BOT-IoT-based algorithmic analysis with varying percentages of learning data for various methods is discussed and represented in Figure4. For this analysis, the learning data varies from 50% to 90% and the maximum performance is attained at 90% of learning data. Testing accuracy based the algorithmic assessment for the BOT-IoT dataset is indicated in Figure 4(a). If learning data is 50%, the testing accuracy value is 0.798 for GA + DSA, 0.779 for PSO + DSA, 0.824 for CS + DSA, 0.878 for HLBO + DSA, and 0.896 for proposed GHLBO + DSA with performance improvement of 10.957%, 13.021%, 8.049%, and 1.961%. Figure 4(b) shows the TPR-based algorithmic analysis for the BOT-IoT dataset. Here, GA + DSA shows the TPR value of 0.794, PSO + DSA shows 0.828, CS + DSA gives the value of 0.848, HLBO + DSA gives 0.869, where the proposed method attains TPR of 0.879 when learning data is 60%. The performance improvement in the TPR value with the proposed model is 9.589%, 5.773%, 3.462%, and 0.990%. The TNR variation with algorithmic analysis from the BOT-IoT dataset is indicated in Figure 4(c). If learning data percentage is 70, TNR values are 0.786, 0.816, 0.783, 0.856, and 0.865 for GA + DSA, PSO + DSA, CS + DSA, HLBO + DSA, and proposed GHLBO + DSA. The improvement in performance values of TNR is 9.081%, 5.660%, 9.443%, and 0.990%.Figure 4
The algorithmic assessment based on BOT-IoT, (a) testing accuracy, (b) TPR, and (c) TNR.
(a)(b)(c)


## 5.4.2. Algorithmic Analysis Based on NSL-KDD

The algorithmic assessment with change in the percentage of learning data from NSL-KDD is given in Figure5. Testing accuracy-based analysis for the algorithm is depicted in Figure 5(a). If learning data is 80%, then the testing accuracy value for the proposed model is 0.894, whereas other methods show lesser values of 0.726 for GA + DSA, 0.834 for PSO + DSA, 0.874 for CS + DSA, and 0.891 for HLBO + DSA. The value of testing accuracy is improved with the ranges of 18.789%, 6.689%, 2.171%, and 0.310%. The TPR-based algorithmic assessment for NSL-KDD is depicted in Figure 5(b). Here, when percentage of learning data = 90, TPR is 0.847 for GA + DSA and increases with values of 0.883, 0.887, 0.896, and 0.909 for PSO + DSA, CS + DSA, HLBO + DSA, and developed method. This shows improvement in performance with the proposed model with values of 6.803%, 2.905%, 2.509%, and 1.542%. Figure 5(c) gives the TNR variation of algorithmic analysis with respect to NSL-KDD. When learning data = 50%, the TNR value for the proposed method is 0.896, and it changes for PSO + DSA, GA + DSA, CS + DSA, and HLBO + DSA with values of 0.885, 0.873, 0.879, and 0.842, accordingly with performance improvement of 2.603%, 1.251%, 1.848%, and 5.982%.Figure 5
The algorithmic assessment based on NSL-KDD, (a) testing accuracy, (b) TPR, and (c) TNR.
(a)(b)(c)


## 5.5. Comparative Assessment

Developed model is compared with various methods, such as TEHO-DBN [28], LUCID [10], the ensemble approach [29], DNN [30], SD-LVQ [4], and FS-WOA [15] by changing learning data.


### 5.5.1. Comparative Analysis Based on BOT-IoT

Figure6 depicts comparative assessment of various methods in terms of BOT-IoT. Testing accuracy based comparative analysis is indicated in Figure 6(a). When learning data percentage = 60, then values of testing accuracy are 0.788, 0.799, 0.833, 0.879, 0.883, 0.886, and 0.897 for TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, FS-WOA, and the proposed method. Improvement in performance with developed model for testing accuracy is 12.159%, 10.920%, 7.184%, 1.961%, 1.56%, and 1.23%. Figure 6(b) shows the TPR-based comparative assessment in terms of BOT-IoT. For, 70% learning data, values of TPR are 0.802, 0.829, 0.844, 0.883, 0.889, 0.892, and 0.901 for TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, FS-WOA, and the proposed method. This shows improvement in performance with 10.997%, 7.936%, 6.367%, 1.961%, 1.33%, and 1%. Figure 6(c) depicts TNR-based comparative analysis in terms of BOT-IoT. When learning data = 80%, TNR values of TEHO-DBN is 0.809, LUCID is 0.836, the ensemble approach is 0.841, DNN is 0.890, SD-LVQ is 0.902, FS-WOA is 0.903, and the proposed method is 0.908. Performance improvement with the developed model in terms of TNR is 10.915%, 7.889%, 7.367%, 1.961%, 0.66%, and 0.55%. The ROC analysis in terms of BOT-IoT is shown in Figure 6(d). When TPR = 3, FPR value of TEHO-DBN is 0.701, LUCID is 0.817, ensemble approach is 0.832, DNN is 0.833, SD-LVQ is 0.836, FS-WOA is 0.839, and the proposed method is 0.867.Figure 6
Comparative analysis in terms of BOT-IoT, (a) testing accuracy, (b) TPR, (c) TNR, and (d) ROC.
(a)(b)(c)(d)


### 5.5.2. Comparative Analysis Based on NSL-KDD

Figure7 depicts the comparative assessment of many methods in terms of NSL-KDD. Testing accuracy based comparative performance is depicted in Figure 7(a). When learning data = 90%, then testing accuracy values are 0.828 for TEHO-DBN, 0.848 for LUCID, 0.878 for the ensemble approach, 0.896 for DNN, 0.898 for SD-LVQ, 0.908 for FS-WOA, and 0.914 for the proposed method. Improvement in performance with the developed model for testing accuracy is 9.378%, 7.167%, 3.851%, 1.961%, 1.75%, and 0.66%, respectively. Figure 7(b) shows the TPR-based comparative assessment in terms of NSL-KDD. For, 50% learning data, values of TPR are 0.799, 0.813, 0.834, 0.869, 0.872, 0.877, and 0.887 for TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, FS-WOA, and the proposed method. This shows improvement in performance with 9.895%, 8.416%, 5.954%, 1.961%, 1.69%, and 1.13%. Figure 7(c) depicts TNR-based comparative analysis in terms of NSL-KDD. When learning data = 60%, TNR values are TEHO-DBN = 0.782, LUCID = 0.771, the ensemble approach = 0.782, DNN = 0.841, SD-LVQ = 0.844, FS-WOA = 0.849, and the proposed method = 0.857. The performance improvement with the developed model in terms of TNR is 8.817%, 10.078%, 8.746%, 1.961%, 1.52%, and 0.93%. The ROC analysis in terms of NSL-KDD is shown in Figure 7(d). When TPR = 3, FPR values of TEHO-DBN is 0.880, LUCID is 0.876, the ensemble approach is 0.881, DNN is 0.853, SD-LVQ is 0.860, FS-WOA is 0.869, and the proposed method is 0.894.Figure 7
Comparative assessment based on NSL-KDD, (a) testing accuracy, (b) TPR, (c) TNR, and (d) ROC.
(a)(b)(c)(d)


## 5.5.1. Comparative Analysis Based on BOT-IoT

Figure6 depicts comparative assessment of various methods in terms of BOT-IoT. Testing accuracy based comparative analysis is indicated in Figure 6(a). When learning data percentage = 60, then values of testing accuracy are 0.788, 0.799, 0.833, 0.879, 0.883, 0.886, and 0.897 for TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, FS-WOA, and the proposed method. Improvement in performance with developed model for testing accuracy is 12.159%, 10.920%, 7.184%, 1.961%, 1.56%, and 1.23%. Figure 6(b) shows the TPR-based comparative assessment in terms of BOT-IoT. For, 70% learning data, values of TPR are 0.802, 0.829, 0.844, 0.883, 0.889, 0.892, and 0.901 for TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, FS-WOA, and the proposed method. This shows improvement in performance with 10.997%, 7.936%, 6.367%, 1.961%, 1.33%, and 1%. Figure 6(c) depicts TNR-based comparative analysis in terms of BOT-IoT. When learning data = 80%, TNR values of TEHO-DBN is 0.809, LUCID is 0.836, the ensemble approach is 0.841, DNN is 0.890, SD-LVQ is 0.902, FS-WOA is 0.903, and the proposed method is 0.908. Performance improvement with the developed model in terms of TNR is 10.915%, 7.889%, 7.367%, 1.961%, 0.66%, and 0.55%. The ROC analysis in terms of BOT-IoT is shown in Figure 6(d). When TPR = 3, FPR value of TEHO-DBN is 0.701, LUCID is 0.817, ensemble approach is 0.832, DNN is 0.833, SD-LVQ is 0.836, FS-WOA is 0.839, and the proposed method is 0.867.Figure 6
Comparative analysis in terms of BOT-IoT, (a) testing accuracy, (b) TPR, (c) TNR, and (d) ROC.
(a)(b)(c)(d)


## 5.5.2. Comparative Analysis Based on NSL-KDD

Figure7 depicts the comparative assessment of many methods in terms of NSL-KDD. Testing accuracy based comparative performance is depicted in Figure 7(a). When learning data = 90%, then testing accuracy values are 0.828 for TEHO-DBN, 0.848 for LUCID, 0.878 for the ensemble approach, 0.896 for DNN, 0.898 for SD-LVQ, 0.908 for FS-WOA, and 0.914 for the proposed method. Improvement in performance with the developed model for testing accuracy is 9.378%, 7.167%, 3.851%, 1.961%, 1.75%, and 0.66%, respectively. Figure 7(b) shows the TPR-based comparative assessment in terms of NSL-KDD. For, 50% learning data, values of TPR are 0.799, 0.813, 0.834, 0.869, 0.872, 0.877, and 0.887 for TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, FS-WOA, and the proposed method. This shows improvement in performance with 9.895%, 8.416%, 5.954%, 1.961%, 1.69%, and 1.13%. Figure 7(c) depicts TNR-based comparative analysis in terms of NSL-KDD. When learning data = 60%, TNR values are TEHO-DBN = 0.782, LUCID = 0.771, the ensemble approach = 0.782, DNN = 0.841, SD-LVQ = 0.844, FS-WOA = 0.849, and the proposed method = 0.857. The performance improvement with the developed model in terms of TNR is 8.817%, 10.078%, 8.746%, 1.961%, 1.52%, and 0.93%. The ROC analysis in terms of NSL-KDD is shown in Figure 7(d). When TPR = 3, FPR values of TEHO-DBN is 0.880, LUCID is 0.876, the ensemble approach is 0.881, DNN is 0.853, SD-LVQ is 0.860, FS-WOA is 0.869, and the proposed method is 0.894.Figure 7
Comparative assessment based on NSL-KDD, (a) testing accuracy, (b) TPR, (c) TNR, and (d) ROC.
(a)(b)(c)(d)


## 5.6. Discussion with Comparison

Comparison is carried out for three evaluation metrics with respect to dual datasets, such as BOT-IoT and NSL-KDD for 90% learning data that is depicted in Table3. For 90% learning data, data taken from the BOT-IoT dataset shows the maximum testing accuracy value of 0.917, the TPR value of 0.908, and the maximum TNR value of 0.909. Hence, proposed GHLBO-enabled DSA is a very efficient method with high ranges of testing accuracy, TPR, and TNR, when compared with other existing methods.Table 3
Discussion with comparison of the proposed technique with existing techniques.
Classification typesMethods/metricsTEHO-DBNLUCIDEnsemble approachDNNSD-LVQFS-WOAProposed GHLBO-basedDSABOT-IoT with 90% learning dataTesting accuracy0.8240.8460.8730.8990.9020.9050.917TPR0.8190.8400.8660.8910.8960.9000.909TNR0.8310.8420.8600.8910.9030.9050.909NSL-KDD with 90% learning dataTesting accuracy0.8280.8480.8780.8960.8980.9080.914TPR0.8280.8480.8710.8910.8940.8990.909TNR0.8160.8270.8660.8830.8860.8920.901Bold values show higher performance compared to other methods.Table4 shows the computational analysis of the GHLBO-based DSA and TEHO-DBN, LUCID, the ensemble approach, DNN, SD-LVQ, and FS-WOA. The minimum computational time of the GHLBO-based DSA is 2.676 sec.Table 4
Computational time analysis.
MethodsTEHO-DBNLUCIDEnsemble approachDNNSD-LVQFS-WOAProposed GHLBO-based DSAComputational time (sec)7.3256.8954.3663.6365.5324.3212.676Bold values show higher performance compared to other methods.


## 6. Conclusion

Cloud computing transforms the IT infrastructure into utility and its characteristics such as utilising virtualisation, relying on the Internet for services, and multiple tenants inherently making the security of the network a major and unpredictable obstacle. The insider DDoS attack is a primary challenge for any cloud operational environment because it deactivates the service completely, and hence, DDoS attack should be completely eradicated as they vary the performance of cloud. In this article, DDoS attacks are detected easily in an optimized way by the proposed GHLBO algorithm. This optimized algorithm is helpful in training DSA that finds attacks in an efficient manner. Here, DMN with the overlap coefficient is responsible for the feature fusion process, and augmentation of data is carried out by oversampling technique. Also, the proposed GHLBO is generated by integrating gradient descent with the HLBO algorithm. Moreover, this proposed method is analyzed by three performance metrics such as TPR, TNR, and testing accuracy with values of 0.909, 0.909, and 0.917. However, the overhead analysis was not considered in the proposed method. This will be considered in the further extension of the devised approach. Also, the advanced optimization method will be included in this approach for better performance and more performance metrics will be considered for the performance evaluation.



---

*Source: 2039217-2023-02-20.xml*