## 2 Background  
### Generic Detection Approaches  
Network traffic analysis approach is one of the most basic ways to protect against DDoS attacks that target IoT devices. The network traffic is monitored for unusual patterns that indicate an ongoing attack. Organizations typically employ this method by integrating intrusion detection systems with other security measures that are intended to detect suspicious network behaviors [23]. These systems create baseline traffic patterns and detect substantial variations, allowing security teams to take action before services degrade. Even though it is widely used, network traffic analysis has some major problems especially when incorporated in IoT environments. Monitoring systems in IoT environments face challenges and difficulties when dealing with massive traffic, resulting in performance degradation and gaps in coverage [24]. Additionally, these methods have trouble handling encrypted communication, which hides packet contents and prevents careful examination. A study by [25] found that detection accuracy drops during flash crowds or seasonal traffic spikes,leading to false alarms. Moreover, comprehensive monitoring needs expensive technology and experienced staff to evaluate findings, which can be costly for organizations with limited security resources. Device monitoring strategies are also crucial for overall security as they focus on individual devices. Analyzing device logs and performance data can reveal specific device behaviors and possible compromise signs [26]. Important factors in reliable security systems include patterns of resource use, communication frequencies, and access scheduling. Reviewing these parameters together aids in locating infected devices displaying non-standard behavior, allowing for focused removal and repair. The IoT landscapes provide significant challenges for the implementation of device monitoring solutions. Many IoT devices with limited computational and storage capacity restrict logging and self-monitoring capabilities [27]. This results in unequal visibility over device populations: some give detailed data while others give little information. Additionally, closed systems and proprietary protocols that resist standardized monitoring complicate data collection even further. [PERSON] et al. [28] found that when the device populations rise into hundreds of millions of endpoints, the centralized collection systems would be overloaded and would cause delays in attack detection. Lastly, privacy concerns add even another level of complication as thorough monitoring may gather private user data, therefore generating problems with regulatory compliance. Signature-based detection is among the first techniques used in networks to detect DDoS attacks. This method relies on known patterns of identified attack vectors, which makes it easier to identify them quickly when matching traffic patterns are present [29]. The implementation requires signature databases with unique byte sequences, packet structures, and connection patterns related to attack methods. The system initiates alarms and implements protective protocols upon the detection of incoming traffic corresponding to specific signatures. Although signature-based methods can quickly identify established attack methods, they have major drawbacks in IoT environments. First, signature-based approaches are ineffective against new or updated attacks not in existing signature databases [30]. Second, signature development lags behind attacker innovation as DDoS attacks develop, creating vulnerability windows between attack emergence and signature deployment. Third, maintenance requirements add additional burden as signature databases need constant improvements. Studies by [31] show that in IoT environments with restricted resources, signature-based solutions generate notable processing overhead, hence possibly influencing operational efficiency. Lastly, large-scale installations may result in too many false positives when the signatures are not detailed enough.