# Detection and Prevention of DDoS Attacks on the IoT
## 1 Introduction
The authors adopted a feedforward back-propagation design with seven secret layers and tested the method for DDoS detection using the most up-to-date Canadian dataset (CIC IDS 2017). The test provided a value of 0.99 scores which means that the experimental results were accurate in terms of Recall and Precision. A resource-friendly ML algorithm called Edge2 Guard (E2G) was introduced in [PERSON] et al. (2007). It was trained and tested over the N-BaIoT dataset of normal and attack network traffic logs recorded by using Mirai and Bashlite Botnets. The algorithm has resource-friendly detection depending on creating an E2G model for each MCU-based IoT device separately in the system. The disadvantage of this algorithm is that the model should be upgraded frequently after being trained with data from the developed type of malware action resulting in rising difficulties in the deployment process. An effective method employing two essential attributes named Volumetric and Asymmetric to detect two forms of flooding-based DDoS attacks was presented in [PERSON] et al. (2007). The proposed DDoS attack detection method based on SDN can cause minimal disruption to effective user activity and reduce both training and testing time. In addition, it proposed the Advanced Support Vector Machine (ASVM) technique to enhance the current Support Vector Machine (SVM) algorithm to detect DDoS flooding attacks effectively. In [PERSON] et al. (2007), a new detection classification system based on SVM and CNN ML algorithms was proposed. It converts the binary files into visualized images in grayscale. Then the CNN and SVM process these images to detect if a file contains maliciously injected code. The accuracy of this method is up to 94% in the binary classification case but only 81% in the multi-classification case. A new ML method based on clustering and graph structure features to predict the occurrence of DDoS attacks was provided in [PERSON] et al. (2007). The method creates the edge and vertex structures in graph theory and extracts eight features of traffic data as input variables. Then uses the principal component analysis (PCA) model to extract the features of DDoS and normal communication. Finally, the fuzzy C-means (FCM) clustering method is used to detect DDoS. The availability of this method is verified by taking 2000 traffic data in CICIDS-2017 as an example. The results of recall, false positive, true positive, true negative, and false negative were 100.00%, 1.05%, 68.95%, 0.00%, and 30.00%, respectively, indicating that it improves the reliability of detection and has a good detection effect on DDoS attacks compared to other methods. In the IoT system, due to the different wireless sensing networks used by the sensing layer, most of them need a gateway for cross-heterogeneous network processing. However, most gateways are used for heterogeneous network processing and do not have a lot of storage space. As a result, anti-virus software cannot be installed on the device, resulting in security vulnerabilities in the system. That makes the storage devices of the IoT the target of malicious attacks tested by novice hackers, among which the most common malicious attack mode includes DDoS attacks, which exhaust the target network or system resources through flood attacks, thereby slowing down or terminating their services. How to detect malicious attacks will be the focus of this paper. In the past, the method of preventing DDoS attacks was to track the source of the attack and block the attack through functions such as Intrusion Detection Systems (IDS) and firewalls. However, with the increasing scale of DDoS attacks in recent years, such as the Mirai zombie virus in 2016, the Dyn.com domain name systems (DNS) services company, Domain Name Services suffered a DDoS attack, affecting websites such as Cable News Network and Twitter [19]. This kind of attack may be a Botnet formed by a large number of IoT devices making massive DNS requests through a large number of IP addresses, resulting in service interruption [20].