# Advancements in Machine Learning-Based Intrusion Detection in IoT: Research Trends and Challenges
## 3 Field Assessment
### DDoS  
A Denial of Service (DoS) attack (commonly referred to as a flood attack), in its simplest form, involves configuring a device on the internet to repeatedly send requests to another computer, bypassing the default settings of the command. The data size of each request can be significantly increased, and the time interval between transmissions can be greatly reduced. As a result, the target device becomes overwhelmed with an excessive amount of unnecessary data, ultimately causing it to stop functioning properly. DDoS attacks are highly covert and cause significant damage by allowing attackers to stay anonymous. The process involves creating malicious code designed to target specific systems when triggered. This code spreads across poorly secured systems on the internet and, once activated, launches an attack from these infected systems simultaneously [15].  
These types of attacks (DoS and DDoS) not only prevent legitimate users from accessing (essential) services, but may lead to further consequences, including increased costs due to service downtime, recovery efforts, or missed opportunities. Consumed bandwidth, processing power, and other network resources cause collateral damage to surrounding systems.  
DDoS attacks, while impossible to completely prevent due to the decentralized nature of the internet, can be effectively managed through a combination of strategies. Adjusting infrastructure configurations is a crucial step, as demonstrated in the late 1990s when default router settings were changed to counter Smurf attacks. A Smurf attack is a type of amplification attack where an attacker sends ICMP echo request packets (pings) to a network's broadcast address, spoofing the source IP to be the victim's address. This causes all devices on the network to respond with ICMP echo replies to the victim, overwhelming their system with traffic. Similarly, addressing vulnerabilities like open recursive Domain Name System (DNS) servers is critical to preventing DNS amplification attacks, although progress in reconfiguring these servers remains slow. Filtering distinct or unusual traffic patterns at ingress points is an effective method to minimize disruption by DoS or DDoS attacks. For instance, upstream routers can block Internet Control Message Protocol (ICMP) echo request traffic to stop ping flood attacks, while other anomalous traffic can be safely discarded based on profile analysis. Distributed hosting infrastructures, such as Akamai, are also useful for dispersing attack traffic across multiple highly connected nodes, reducing the impact on any single target. However, short DNS Time-To-Live (TTL) values provide limited benefit unless TTL entries are completely removed. A robust mitigation strategy typically involves a multi-layered approach. Identifying and shutting down source Internet Protocol (IP) addresses, deploying routing tricks to drop malicious traffic, and using high-speed line filtering devices to manage extraneous traffic are all effective techniques. Defensive measures like SYN proxies can also reduce the effectiveness of certain types of attacks. SYN proxies are a defensive technique against DDoS attacks that involve intercepting and managing TCP handshake requests. In large-scale scenarios where attack traffic reaches tens of gigabits per second, collaboration with Internet Service Providers (ISPs) to filter incoming traffic becomes essential to maintain normal operations and protect the network [16].  
This literature review aims to help further researchers in leveraging machine learning and artificial intelligence to identify and respond to DDoS attacks in real-time by presenting the current state of the field. To achieve this, we take a closer look at popular datasets and ML techniques already used in relevant studies. We try to identify general trends and compare the outcomes of the respective studies.