Nowdays, DNNs (Deep Neural Networks) are widely used in the field of DDoS attack detection. However, designing a good DNN architecture relies on the designer’s experience and requires considerable work. In this paper, a GA (genetic algorithm) is used to automatically generate the DNN architecture for DDoS detection to minimize human intervention in the design process. Furthermore, given the complexity of contemporary networks and the diversity of DDoS attacks, the objective of this paper is to generate a DNN model that boasts superior performance, real-time capability, and generalization ability to tackle intricate network scenarios. This paper presents a fitness function that guarantees the best model generated possesses a specific level of real-time capability. Additionally, the proposed method employs multiple datasets to joint models generated, thereby enhancing the model’s generalization performance. This paper conducts several experiments to validate the viability of the proposed method. Firstly, the best model generated with one dataset is compared with existing DNN models on the CICDDoS2019 dataset. The experimental results indicate that the model generated with one dataset has higher precision and F1-score than the existing DNN models. Secondly, model generation experiments are conducted on the CICIDS2017 and CICIDS2018 datasets, and the best model generated still performs well. Finally, this paper conducts comparative experiments on multiple datasets using the best model generated with six datasets and the best model generated by existing methods. The experimental results demonstrate that the best model generated with six datasets has better generalization ability and real-time capability.

Classifying mobile applications from encrypted network traffic is a common and basic requirement in network security and network management. Existing works classify mobile applications from flows, based on which application fingerprints and classifiers are created. However, mobile applications often generate concurrent flows with varying degrees of ties, such as low discriminative flows across applications and application-specific flows. So flow-based methods suffer from low accuracy. In this paper, a novel mobile application-classifying method is proposed, capturing relationships between flows and paying attention to their importance. To capture the inter-flow relationships, the proposed method slices raw mobile traffic into traffic chunks to represent flows as nodes, embeds statistical features into nodes, and adds edges according to cross-correlations between the nodes. To pay different attention to the various flows, the proposed method builds a deep learning model based on graph attention networks, implicitly assigning importance values to flows via graph attention layers. Compared to recently developed techniques on a large dataset with 101 popular apps using the Android platform, the proposed method improved by 4–20% for accuracy, precision, recall, and F1 score, and spent much less time training.