# Machine Learning-Based DoS Amplification Attack Detection against Constrained Application Protocol
## 2 Related Work
### Proposed Defense Mechanisms for IoT Network
#### 2.1.3 Cloud Platform for IoT Network Security
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Research Objective** & **Methodology Used** & **Results** & **Limitations** \\ \hline Employ Mobile Edge Computing (MEC) to safeguard IoT environment (2017) & MECshield is proposed that uses smart filter distributed over MEC to mitigate DDoS attack & Better detection accuracy and DDoS bottleneck is resolved & N/A \\ \hline Design framework for Software-Defined Internet of Things (SD-IoT) (2018) & SD-IoT uses cosine similarity of the vectors of the incoming packet and based on that it decides if a DDoS attack is triggered or not. & Detect and block the attack at the source & Susceptible to large amounts of traffic \\ \hline Edge computing-based cloud platform (2018) & Cloud ShadowNet web service will receive the packets from edge nodes to vet them & It performs 10\(\times\) faster in detecting UDP flood attack than existing models & Focus on speed but ignore accuracy since no method to differentiate between attack and Flash crowd \\ \hline Anomaly-based detection to detect IoT traffic attacks (2018) & Deep Autoencoders is used to learn the behavior of normal IoT traffic and then detect the anomalies if re-construction has failed & N-BaIoT succeeded in detecting every single attack with 100\% TPR & Deployment in a real-world scenario is costly \\ \hline Securing tenant IoT network (2018) & TNGuard degrades the tenant network administrator to ensure the security & Several metrics used show sufficient work with most of the applications & Lack of dynamic integrity verification \\ \hline Deploy SDN and cloud to secure IoT network (2018) & Delegate security mechanism to the cloud and management to the controllers and data plane to gateways & Security architecture containing trusted SDN controllerk & Not tested in real environment \\ \hline Detect DDoS based on the traffic behavior (2019) & Anomaly-based detection that measures the deviation of any traffic compared to legitimate traffic from the same class & Adaboost can effectively detect anomalies in the traffic behavior & No significant criterion to classify IoT devices \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Proposed Defense Mechanisms for IoT Network. In terms of dataset uniquity, there are different datasets available for DDoS CoAP attacks. The Bot-IoT [29] has a variety of attacks including DoS attacks; however, it does not include DoS CoAP amplification attacks. A NetFlow dataset was generated from UNSW-NB15, Bot-IoT, ToN-IoT, and CSE-CIC-IDS2018 due to the lack of related features for malware detection [30]. The authors claimed that most Network Intrusion Detection Systems (NIDS) datasets do not contain sufficient security events. For this purpose, they generated a new dataset from the NIDS datasets and included the security events for research purposes. This dataset does not have specific amplification malware for the DoS CoAP attacks. The IoT-Flock dataset [31] was generated for the IoT network attacks. However, this dataset was dedicated to healthcare applications. It can be safely assumed that no dataset has been generated by any researcher so far for simulating the DoS CoAP amplification attacks that contain simple, observe, and multicast amplification.