# Security Analysis of DDoS Attacks Using Machine Learning Algorithms in Networks Traffic
###### Abstract  
The recent advance in information technology has created a new era named the Internet of Things (IoT). This new technology allows objects (things) to be connected to the Internet, such as smart TVs, printers, cameras, smartphones, smartwatches, etc. This trend provides new services and applications for many users and enhances their lifestyle. The rapid growth of the IoT makes the incorporation and connection of several devices a predominant procedure. Although there are many advantages of IoT devices, there are different challenges that come as network anomalies. In this research, the current studies in the use of deep learning (DL) in DDoS intrusion detection have been presented. This research aims to implement different Machine Learning (ML) algorithms in WEKA tools to analyze the detection performance for DDoS attacks using the most recent CICDDoS2019 datasets. CICDDoS2019 was found to be the model with best results. This research has used six different types of ML algorithms which are K_Nearest_Neighbors (K-NN), super vector machine (SVM), naive bayes (NB), decision tree (DT), random forest (RF) and logistic regression (LR). The best accuracy result in the presented evaluation was achieved when utilizing the Decision Tree (DT) and Random Forest (RF) algorithms, 99% and 99%, respectively. However, the DT is better than RF because it has a shorter computation time, 4.53 s and 84.2 s, respectively. Finally, open issues for further research in future work are presented.  
c 2021 102910  
According to a CISCO report [3], there will be a huge growth in the number of DDoS attacks in the near future. According to the statistics presented in [3], by 2022, the amount of DDoS attacks will be doubled to 14.5 million, in contrast to 2017. Figure 2 shows the global increase in the number of DDoS attacks between 2017 and 2022. Because of the increasing size and traffic of DDoS attacks rapidly, there is a serious threat to service providers, and the highest reported attack was 1.7 Tb/s [2]. Recently, the cost of downtime caused by DDoS attacks was significantly high, and it has cost USD 221,836.80 [2]. Comparing between 2017 and 2018, the number of attacks against IPS devices and firewalls was nearly doubled from 16% to 31%, respectively [2]. During this time, DDoS attacks have also increased from 11% to 34% against cloud-based services and third-party data centers.  
The DDoS attacks are still on the top of threats due to the accessibility of business applications, services and networks. There is a similarity between DDoS attacks and non-malicious availability issues such as system administrators performing maintenance or technical problems with the network [4; 5]. These issues lead to significant challenges to accurately identify and powerfully defend these types of attacks. The network performance for gaining access to files or inaccessibility of a specific website can be slow when trying to recognize a DDoS attack [6].  
Criminals demonstrating attack capabilities, gaming, and extortion were the highest motivations behind these attacks in 2017 [2]. Continuously, the attackers are beefing up their computing capacity to make DDoS attacks [7]. The main contribution of this research  
Figure 1: The Taxonomy of DDoS attack [3].  
Figure 2: Global DDoS attacks forecast 2017–2022.  
is to implement different machine learning (ML) algorithms in WEKA tools to analyze the detection performance for DDoS attacks using the most recent CICDDoS2019 datasets. This research has used six different types of ML algorithms: K-NN, SVM, NB, DT, RF, and LR.  
There is a need to design and develop intelligent security solutions for the protection of IoT devices and against attacks generated from compromised IoT devices.