Two-Phase Deep Learning-Based EDoS Detection System

Round 1

Reviewer 1 Report

Authors have presented a novel strategy for detecting each abnormal flow in
network traffic while reducing the required sequence length of the input data. However, authors need to proofread the paper and must keep consistency  in all figures and equations. 

 

Author Response

Please see the attachment.

Author Response File: Author Response.docx

Reviewer 2 Report

The article entitled "Two-phase Deep Learning-based EDoS Detection System" which has been submitted to the Applied Sciences Journal has an excellent scientific impact and it can be taken into account to be published in this Journal. There are just three wo things that need to be explained better.

1) There are some constraints with the information given in the Training database to be used with the LSTM Model. How this database was obtained? 

2) Also, it is not so clear how many training and validation samples were used to get those results.

3) The conclusions should justify and explain the most relevant findings of this study.

Author Response

Please see the attachment.

Author Response File: Author Response.docx

Reviewer 3 Report

The authors have reported the study on  a two-phase deep learning-based EDoS detection scheme that uses an LSTM model to detect abnormal flow in network traffic.  In general, the paper is well written and the main conclusions presented in the paper are well supported by the figures and supporting text. However, to meet the journal quality standards, the following comments need to be addressed

 

 

 

1. Page :2 “a disadvantage of an LSTM or other variants of an RNN in anomaly detection is the required long sequence length of 53 the model, which requires the defense system to use such algorithms, ”.. do the authors think attention based transformer can be useful in the present study?
2. Section 2and 3 : related works and background can be shortened. It is  too exhaustive, only relevant literatures can be mentioned.
3. Figure 8, 9: legend can be placed in the free space.
4. Page 14 : “Additionally, we simulate another attack that attack the victim at the application layer called TCP-HTTP flooding  attack (HTTP attack) to demonstrate that our proposed scheme not ….. layer” the reader does not quite understand why this part is necessary  ?
5. The authors have compared their model with 3 other models, but did not mention if they are state-of-the-art models? It should  be elaborated.

 

 

 

6. Results and discussion: - The paper is overall descriptive can be improved such as limitations of the results should be highlighted. It would be interesting to discuss whether the EDoS Detection presented here can be captured using CNN-based models to extract feature identifier  [ see : AI 2021, 2(3), 413-428; https://doi.org/10.3390/ai2030026; Sensors 2021, 21(9), 3263;https://doi.org/10.3390/s21093263]. Hence it should be addressed in the introduction
7. The discussion section can be strengthened.
8. Typographical errors: There are several minor grammatical errors and incorrect sentence structures. Please run this through a spell checker.

Author Response

Please the attachment.

Author Response File: Author Response.docx

Round 2

Reviewer 3 Report

The authors have addressed the reviewer's previous commnets. This manuscript can be published in its present form.