## 2 Background
### Machine Learning Models  
Recurrent neural networks (RNN) were inspired by the biological human brain and are well-suited for many tasks. Unlike standard neural networks (feed-forward neural network), RNNs contain loops that provide short-term memory, enabling them to use previous inputs to shape current and future outputs. LSTM [38] networks are a type of RNN capable of capturing long-term dependencies. LSTM units contain specialized memory cells combined with standard recurrent units, enabling the network to remember information for an extended period of time. The information stored within these cells is managed by gates, including the input, output, and forget gates [38; 39].  
Support vector machine (SVM) is a supervised learning machine model developed by [PERSON] et al. [40] in the 1990s. It is commonly used for classification and regression. By determining the optimal hyperplane, the model effectively splits data into distinct categories while maximizing the gap between classes. SVM initially only supported linear classification, then it evolved to non-linear classification problems. Linear SVMs split using a straight line. Nonlinear SVMs classify more complicated data patterns. SVMs are utilized in machine learning in many fields, such as text classification, spam identification, and prediction [40].  
K-nearest neighbors (KNN) is a supervised learning algorithm that classifies or predicts values based on similarity to existing examples. Unlike other algorithms that build models while training, RNNs save data and decide what to do when necessary by finding the K training examples that are closest to a new point and voting or taking the average of those. The choice of distance measure such as Hassanat, Euclidean, and Manhattan significantly affects the performance. KNN works best when data are properly scaled, the right distance measure is selected, and an appropriate K value is chosen. Though KNN simplifies the processing of complicated patterns, KNN maintains high precision even in the event of up to 90% noise in the data [41; 42].  
Random forest is a supervised learning technique that uses many decision trees working together to make predictions. Designed by [PERSON] in 2001 [43], it generates many trees using random data points and features, then aggregates the results. It is capable of working efficiently with complex data and relationships, requires minimal modification, accommodates missing data, and identifies the most critical variables. The method effectively identifies DDoS attacks by distinguishing malicious from legitimate network activity and evaluating anomalous traffic patterns. Combining several trees improves the algorithm's reliability by preventing overfitting and improving prediction accuracy on new data [43; 44; 45; 46].  
Convolutional neural networks (CNNs) are a subset of DL architectures, developed in the 1980s by [PERSON] [47]; these networks extract hierarchical characteristics from incoming data by performing convolution operations through a number of processing layers. CNNs were originally inspired by biological visual processing systems; however, they have expanded their capabilities beyond picture classification to include text, audio, and network traffic classification. CNNs instantly learn the best way to describe features straight from data, which makes classification more accurate across a wide range of domains. This is in contrast to traditional ML techniques that require manual feature engineering. Due to their capacity for self-learning, sharing of parameters, and preservation of spatial correlations, CNNs have emerged as powerful AI tools for pattern recognition and classification tasks [48; 49].