## 1 Introduction  
Before 2000, denial-of-service (DoS) attacks targeting specific locations were launched in a fairly simple fashion, such as flooding, ping of death, tear drop, smurf, land attack, and so on [1]. Since then, however, malicious actors have been used to make the most of distributed DoS (DDoS) attacks targeting DNS route servers to sabotage URLs and IP addresses over the internet [2]. Companies rushed to build cyber defenses in the wake of such a type of cybercrime, but after the year 2005, distributed reflected denial of service (DDoS) attacks emerged, using multiple botnets that overwhelm the defense infrastructure [3]. These days, hackers use more sophisticated and more advanced DDoS methodologies such as Smart Attack, to achieve nefarious goals. This ever-evolving vector of cyber raids typically includes ransom DDoS that is a tactic to demand money from companies in exchange for ending a significant intrusion, and Memcached Reflection that is an attack aimed at the Memcached server by exploiting it by sending forged requests for cashing data stored therein, using a spoofed IP address to make the victim server trigger massive responses. As shown in Figure 1, Github was hit in February 2018 by a DDoS attack utilizing cached data. It was the largest ever recorded Memcached reflection DDoS attack, peaking at 1.35 Tbps, with the amplification power by a factor of 51,000 [4]. More recently, a new variant of cyberattacks, called carpet bombing, emerged. Most of the ransom DDoS attacks sporadically seen from October 2020 have been in the form of carpet bombing. Carpet bomb attacks are very hard to detect an attack or identify the targeted subject as they can slide right below a baseline that DDoS mitigation solutions rely on by simultaneously dispersing traffic to multiple IPs, not one, at the same bandwidth [5]. Initiating a DDoS attack requires multiple servers, PCs, or terminals. A botmaster builds a botnet by spreading malware targeting vulnerable applications and making use of a group of devices which have been infected via drive-by-download and come under his/her control. Once prepared, the botmaster-attacker issues commands to the botnet to trigger large-scale traffic. Therefore, all of DDoS attacks are proportional, in terms of their consequential severity, to the scale of the botnet mobilized, where most DDoS attacks use multivector attacks often combined with other types of attack vectors. For example, if a GET flooding attack, which causes the target (e.g., web or DB) to be overloaded, is used in combination with a UDP flooding attack, which saturates bandwidth by overwhelming the target, it becomes harder to differentiate attack traffic from normal traffic, making it difficult to make timely countermeasures. The success of the volumetric DDoS attack is proportional to the size of a given botnet. Since IoT services became popularized, malicious actors began to make the most of numerous IoT devices for their DDoS attacks, appearing to be even a few Tbps in size [6]. A typical example of a DDoS attack enslaving IoT devices was OVH, a French hosting company, which suffered a 1 Tbps DDoS attack in September 2016, where the attacker was known to take use of 145,000 CCTVs for the attack [7]. Moreover, in the case of Dyn, a U.S. hosting company, which was the victim of a 1.2 Tbps DDoS attack occurring in October 2016, where all of Dyn's service centers around the world were attacked, causing thousands of DNS servers to be interrupted, thereby crippling the internet across the U.S. East Coast. It was later found that the attacker had mobilized hundreds of thousands of connected devices for the attack [8]. While 5G accelerates a new wave of IoT applications, 5G-networking IoT adoption tends to proliferate in the fields of medicine, smart home, smart factory, and smart farming, covering almost all sectors, whereby DDoS attacks naturally turn their eyes to the realm of 5G service networks.