# FedDB: A Federated Learning Approach Using DBSCAN for DDoS Attack Detection
## 2 Related  
Current methods for addressing DDoS attacks primarily utilize machine learning (ML) techniques, incorporating various artificial intelligence (AI) models for detection and mitigation. ML is the preferred choice for modern DDoS detection, particularly in the face of increasingly sophisticated and evolving cyber threats because it offers significant advantages over traditional DDoS detection methods, including adaptability, accuracy, automation, scalability, a diverse range of algorithms, and continuous improvement [9]. This article introduces machine learning methods and other approaches, such as threshold-based techniques, highlighting that no single algorithm can perfectly address all challenges or suit every scenario in DDoS detection. Moreover, different methods have varying evaluation criteria. Therefore, when designing a DDoS detection mechanism, it is essential to select an appropriate algorithm based on the specific scenario, considering factors such as normal network traffic, the potential types of DDoS attacks, and the datasets used. As machine learning methods have achieved higher accuracy and effectiveness in many practical applications. The following literature highlights significant results obtained using Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM) networks, and Recurrent Neural Networks (RNNs). Each machine learning model has its own advantages. CNNs have shown great potential in detecting Distributed Denial of Service (DDoS) attacks. Reference [10] proposes a hybrid neural network structure called DDoSTC, which combines efficient and scalable Transformers with CNNs for detecting DDoS attacks on Software-Defined Networks (SDNs). Tested on the CICDDoS2019 dataset, DDoSTC outperformed existing models in terms of average AUC, accuracy, recall, and F1 Score. Reference [11] employs CNNs to detect DDoS attacks by analyzing IP flow features. CNNs, as part of the detection module, are responsible for identifying abnormal network traffic potentially indicative of DDoS attacks. This method achieved approximately 95.4% accuracy in detecting different types of DDoS attacks. Reference [12] proposes a method using CNNs to detect DoS and DDoS attacks by converting network traffic data into image format. Standardized network traffic data are converted into three-channel images, enabling CNNs to analyze data more effectively. This method achieved 99.99% accuracy for binary classification and 87.06% accuracy for multi-class classification on the CICDDoS2019 dataset. Overall, CNN-based methods have demonstrated excellent performance in various scenarios. LSTMs are frequently used for DDoS attack detection. Reference [13] uses a deep learning model based on Long Short-Term Memory (LSTM) networks to detect DDoS attacks that was capable of handling time-series data and long-term dependencies. Reference [14] presents an LSTM-based deep learning model that effectively addresses the gradient vanishing problem commonly encountered in traditional Recurrent Neural Networks (RNNs), thereby learning better from sequential data, which are prevalent in network traffic patternsrelated to DDoS attacks. This research demonstrated a high accuracy of up to 99.19% in detecting DDoS attacks using the CICDDoS2019 dataset. Reference [15] introduces a model named DDoSNet, which combines RNNs with autoencoders to detect DDoS attacks in SDN environments. The RNN-Autoencoder architecture extracts features from input data automatically, classifying network traffic as normal or malicious, thereby reducing data dimensionality. This approach effectively handles complex nonlinear relationships in network traffic, crucial for accurate DDoS attack detection. The DDoSNet model achieved 99% accuracy in evaluations using the CICDDoS2019 dataset. In addition to accuracy, other metrics such as precision, recall, and F1 Score demonstrate the model's effectiveness in detecting attacks and distinguishing benign traffic.