# RAPT: A Robust Attack Path Tracing Algorithm to Mitigate SYN-Flood DDoS Cyberattacks
## 2 Related Work
### Detection and Classification Approaches  
The detection and classification approaches can be subdivided into the below categories:  
1. **Statistical Approaches**: Statistical models are built on benign and malicious DDoS traffic, which are then applied to detect and classify DDoS attacks. In [9], DDoS Shield classifies DDoS attacks based on the exploited application workload parameters. The threshold values are preset on the workload parameters based on the measurements and labels the behaviors exceeding the thresholds as malicious. Ref. [10] proposed a scheme that detects floods of HTTP GET by modeling the webpages' browsing order and finding the correlation between browsing time and the pages' information size. In general, statistical approaches are efficient and controllable providing good accuracy in discovering simple DDoS attacks such as HTTP flood and slow DDoS attacks; however, they might not be efficient in handling complicated attacks. 2. **Learning Approaches**: With the machine learning algorithms' advancement and ability to provide intelligent solutions, many researchers are harnessing these techniques on big data for detecting DDoS attacks. In [11], the authors proposed a three-layer feed-forward neural network that detects DDoS attacks using extracted features from the packets' header fields. Ref. [12] applied Stacked AutoEncoder, which is a deep  
Figure 1: Research methodology phases. learning scheme that aims to receive high-level features and generates features from web server logs building a logistic regression classifier to determine DDoS attacks. ARTP [13] detects DDoS attacks by leveraging the K-means algorithm and conducting analysis on features such as request's interval, chain context, and length. To summarize, leveraging machine learning techniques to identify DDoS have mixed results depending on the feature extraction approach, the scheme's design, and the learning algorithm. 3. **Markovian Approaches**: A Markov model is defined as a stochastic model that models randomly changing events in probability theory [14]. It works by assuming that the future state depends on the current state only, and the next state can be inferred by conducting probability analysis on its past. The works in [15; 16; 17; 18] track the correlated behavior of users and utilizes hidden semi-Markov model with a random-walk graph for tracing the DDoS attacks. Markov-based approaches are the state of the art because DDoS attacks are stateful. To address stateful issues, Markov-based approaches can provide fine-grained and highly accurate detection and classification results. 4. **Probabilistic Packet Marking Approaches**: In [19; 20], the scheme suggests that routers randomly mark IP packets using an edge identifier, which is the start and end points of a single hop in the packet path. If enough packets are sent, the victim can construct the attack path through the parameterized packets. In this scheme, it is suggested that the information to be encoded in the identification field of the IP header. However, the modification of the identification field in the IP header could lead to the failure in assembling the fragments completely. In [21], Traffic-Aware Probabilistic Packet Marking (TAPPM) was proposed, which is a collaborative DDoS mitigation framework based on traffic-aware probabilistic packet marking. It enables the victim to select some of the hit routers as collaborators to mitigate attack traffic depending on the traffic distribution. In [22], the authors proposed a solution to the Interest Flooding Attack (IFA) in Named Data Networking. The solution leverages hypothesis testing theory to develop a Generalized Likelihood Ratio Test adapted to evolved IFA attacks. The work presented in [23] suggests an overview of the main cloud vulnerabilities, along with solutions proposed for the H2020 CLARUS project. It provides monitoring techniques for intrusion detection and prevention, including attack tolerance mechanisms. In [24], a trusted multidomain DDoS detection method based on federated learning was proposed.