# Detection and Prevention of DDoS Attacks on the IoT
## 4 Results and Discussion  
In this paper, TFN2K is used to collect packet traffic statistics, CPU and memory usage, average network speed, and other characteristics for five scenarios, including normal transmission, SYN flood attack, UDP flood attack, ICMP flood attack, and MIX flood attack. The collected data are preprocessed to build a packet traffic dataset and packet feature dataset, respectively, which can be used as the data for artificial intelligence model training. In this paper, the packet traffic is monitored for five minutes, and the relevant features of the packet traffic during this period are captured. Figure 16a-e shows the total number of TCP, UDP, ICMP, and other packets under the normal transmission, SYN flood attack, UDP flood attack, ICMP flood attack, and MIX flood attack, respectively. The ordinate is the cumulative total number of packets, and the abscissa is the number of counts per 3 s.  
Figure 16: Packet flow cumulative diagram. (**a**) Normal transmission; (**b**) SYN flood attack; (**c**) UDP flood attack; (**d**) ICMP flood attack; (**e**) MIX flood attack. Figure 16a-e shows the total number of TCP, UDP, ICMP, and other packets under the normal transmission, SYN flood attack, UDP flood attack, ICMP flood attack, and MIX flood attack, respectively. From Figure 16a, it can be seen that under normal transmission conditions, there are all kinds of packets, and the cumulative number of packets increases moderately. However, no matter what kind of flood attack, the cumulative number of packets increases suddenly. Moreover, there are different cumulative numbers for different packet types when under attack. These characters can not only be used to judge whether an attack has been suffered but also can be used to identify the type of attack. The experimental retrieval time is 5 min, so there are 100 records. Compared with Figure 16a, it can be seen in Figure 16b that suffered from an SYN flood attack, its TCP packets increased a lot, and the total number of TCP packets flowing through IP1 within 5 min was about 50,000, and other types of packets are almost equal to 0. In Figure 16c of the UDP flood attack, it can be seen that UDP packets have increased a lot, while other types of packets are almost equal to 0. The collection time is 5 min. It can be seen that the sum of UDP packets during this period reached about 40000. In Figure 16d of the ICMP flood attack, it can be seen that ICMP packets increased a lot, while other types of packets are almost equal to 0, and the collection time is 5 min. During this period of time, the sum of ICMP packets also reached about 40,000. Figure 16e shows the situation of being attacked by other packets (MIX flood attack). At this time, the server flows through a large number of various types of packets, and the number of packets with UDP and TCP characteristics is almost the same. Therefore, in our experiment, it is obvious to observe that when attacked, the increase of various packets with this time and the change of the number of packets. Figure 17a-e are the usage rates of their CPU and memory, respectively. As can be seen from Figure 17a, the CPU usage rate changes little during normal transmission, but it will fluctuate greatly under attacks. Similarly, the memory usage rate is much lower under normal transmission than under attacks. It helps to detect whether the system is under attack. In Figure 17b, it can be seen that when an SYN flood attack is encountered, the usage rate of CPU is about 20% higher than that in Figure 17a under normal conditions. As shown in Figure 17c, when suffering from UDP flood attacks, the CPU usage rate fluctuates violently, and its highest usage rate reaches more than 50%. In Figure 17d, we can see that when the ICMP flood attack is encountered, the CPU's usage rate fluctuates violently. The situation of the oscillation is the same as that of the UDP flood attack, but it has different characteristics.