# Deep-Learning-Based Approach to Detect ICMPv6 Flooding DDoS Attacks on IPv6 Networks
## 3 Related Works  
Anomaly intrusion detection systems (AIDS) can detect DoS and DDoS attacks on IPv4 and IPv6 networks, employing various algorithms to achieve their stated goals. However, ML and DL algorithms are among the most prominent algorithms used in AIDS that achieve highly accurate detection of DoS and DDoS attacks. This section discusses the existing intrusion detection systems (IDS), including their limitations. To detect ICMPv6 attacks, [PERSON] et al. [5] proposed a flow traffic representation and employed seven ML classifiers. The proposed system was tested and evaluated using an IPv6 dataset. However, experiment results show that it achieved a low detection accuracy for such attacks. Another flow-based IDS approach was proposed by [PERSON] et al. [10] based on ML techniques for detecting Neighbor Discovery Protocol (NDP) DDoS attacks. The method was tested and evaluated with IPv6 dataset. As a result, the proposed approach detected 99% NDP DDoS attacks and 91.17% replay attacks within the dataset. However, the proposed system is limited to detect NDP attacks. Meantime, [PERSON] et al. [11] proposed an ML-based approach for detecting DDoS attacks in IPv6 networks. As a classi  
Figure 2: A cell of GRU. fication result, the approach achieved better detection results. However, no information about detection accuracy was provided, and it was evaluated using an IPv4 KDD Cup 99 dataset. Moreover, [PERSON] et al. [25] developed another approach for detecting RA DDoS flooding attacks by employing two methods for feature selection: principal component analysis (PCA) and information gain ratio (IGR). In addition, they also utilized the SVM algorithm for the prediction model, then tested and evaluated the model using an IPv6 dataset, achieving a detection accuracy of 98.55% and a false-positive rate of 3.3%. However, this approach only detects router advertisement (RA) attacks. Next, an alternative approach was developed by [PERSON] et al. [12] that employs the IGR and PCA to rank and select the relevant network traffic features before using the back-propagation neural network (BPNN) algorithm, achieving 98.3% detection accuracy. However, the proposed system only detects ICMPv6 echo request attacks. Additionally, [PERSON] et al. [26] proposed an ML-based framework based to determine the relevant features to detect IPv6 attacks, particularly RA flooding attacks. As a result, the framework achieved a 99.95% average accuracy rate. However, it is limited to RA attacks. In addition, [PERSON] et al. [3] proposed a machine learning system to detect NDP DDoS attacks in IPv6 network. They used classical machine learning algorithms. As a result, the decision tree (DT) and random forest (RF) algorithms achieve better results than other classifiers' algorithms. However, the proposed system performance is low. Finally, [PERSON] et al. [27] proposed a security model to detect and classify covert channels in IPv6 networks by employing the naive Bayesian classifier (NBC). As a result, the proposed model achieves good detection accuracy and a good true positive rate. However, the proposed approach's performance needs to be improved. Table 1 lists several ML-based approaches designed to detect specific forms of ICMPv6 flooding DDoS attacks. For example, [PERSON] et al. [25] proposed an approach that detects RA DDoS flooding attacks, while [PERSON] et al. [12] proposed a detection approach for echo request DDoS attacks. In addition, [PERSON] et al. [5] proposed a flow-based IDS that detects ICMPv6 flooding DDoS attacks but only achieves low performance. [PERSON] et al. [10] proposed a flow-based system limited to detecting NDP attacks and replay attacks. [PERSON] et al. [11] proposed an approach for detecting DDoS attacks in IPv6 networks. However, the proposed approach was evaluated using an IPv4 dataset even though IPv6 is totally different from IPv4. Additionally, [PERSON] et al. [26] proposed a framework to determine significant IPv6 features for detecting RA DDoS flooding attacks. [PERSON] et al.