## 2 Related Works
[14] proposed a hybrid machine-learning-based technique to detect these attacks. The extreme learning machine (ELM) model and the black hole optimization algorithm implement the proposed technique. Several experiments proposed an evaluation of the performance of their proposed method. Additionally, several experiments were conducted using four benchmark datasets: NSL KDD, ISCX IDS 2012, CICIDS2017, and CICDDoS2019. With these four datasets, the accuracy reached 99.23%, 92.19%, 99.50%, and 99.80%, respectively. Moreover, a comparison is carried out on the following: Alternative ELM-based techniques, ANNs trained with blackhole optimization, backpropagation ANNs, and other state-of-the-art techniques. [PERSON] et al. [15] investigated deep-learning-based models for DDoS classification: Long short-term memory (LSTM) and convolutional neural networks (CNN). The dataset was dynamically generated via Mininet, using OpenFlow switches and Floodlight as an external controller. The results showed that RNN LSTM achieved an accuracy of 89.63%, outperforming linear-based models, such as SVM (86.85%) and Naive Bayes (82.61%). The KNN algorithm, a linear-based model, had an even higher accuracy than their model accuracy of 99.4%. Moreover, the model performed best when using a data split of 70/30 (train/test split ratios). [PERSON] and [PERSON] [16] proposed a hybrid autoencoder model called MSCNN-LSTM-AE, which uses a combination of a multi-scale convolutional neural network (MSCNN) and LSTM to find anomalies in network traffic. The approach first uses the MSCNN-autoencoder to evaluate the spatial features of the dataset, then an LSTM-based autoencoder network is used to identify the temporal features of the latent space features learned from MSCNN-AE. For testing, the authors used UNSW-NB15 [17], NSL-KDD [18], and CICDDoS2019. Their model (MSCNN-LSTM-AE) achieved an accuracy of 93.76% and recall of 92.26%. [PERSON] et al. [19] proposed an optimized feed-forward neural network model for detecting IoT-based DDoS attacks through network traffic analysis directed at a specific target, which could be monitored continuously by a tap. The proposed model applies to DoS and DDoS attacks involving TCP, UDP, and HTTP flood, keylogging, data exfiltration, OS fingerprinting, and service scan activities. It simply distinguishes this network traffic from normal network flows. As a solver, the neural network employs Adam optimization and the hyperbolic tangent activation function in all neurons from a single hidden layer. Depending on the targeted accuracy and processing speed, the number of hidden neurons can be varied. Testing on the BotIoT dataset reveals that developed models can be used with 8 or 10 features and have a discrimination error of 4.91 \(\times\) 10\({}^{-3}\)%. [PERSON] et al. [20] proposed a multimode framework based on voting to combat volumetric DDoS (VMFCVD) attacks. VMFCVD is based on three different detection modes: Fast detection mode (FDM), defensive fast detection mode (DFDM), and high accuracy mode (HAM). FDM is designed to classify network traffic when a server is under attack. The highly dimensional and reduced dataset aids FDM's detection speed. In most cases, the dimension reduction for FDM was greater than 97%, while maintaining an accuracy of 99.9% during our experiment. DFDM is an enhanced version of FDM that improves the detection accuracy of malicious network traffic by tightening the detection technique. HAM focuses on detection accuracy, outperforming FDM and DFDM significantly. When the server is stable, HAM is activated. VMFCVD has been extensively tested on the most recent benchmark DDoS and botnet datasets, including the UNSW NB15, UNSW2018 BotIoTIoT, CSE-CIC-IDS2018 (BoT and DDoS), CICIDS2017 (BoT and DDoS), DoHBrw2020, NBaloT2018 (Mirai), and CICDDoS2019 (DNS, LDAP, SSDP, and SYN). The results of VMFCVD show that it outperforms recent studies. When the server is under a DDoS attack, VMFCVD performs remarkably.