# Detecting DDoS Attacks in IoT-Based Networks Using Matrix Profile
## 3 Methodology: Matrix Profile
### Problem Definitions and Notation  
In this section, we provide some definitions of terms used in this paper regarding matrix profile, which is a tool or method to detect IoT-based DDoS attacks.  
**Definition 1**.: _Assume a time series \(T\) where \(T\) is a sequence of real-value numbers \(t_{i}:T=t_{1}\), \(t_{2},\ldots,t_{n}\), and \(n\) is the length of the time-series data (\(T\))._  
We do not look at all global properties of the time-series data. We investigate the similarity between local sub-sequences. As a result, we find the anomaly [37].  
**Definition 2**.: _Define \(T_{i,m}\) of \(T\) as a continuous subset of values where \(m\) is the length of the sub-sequence data vector, \(i\) is the index of the first value in the subset in \(T\), and \(1\leq i\leq n-m+1\)._  
It is possible to take part of the sequence (sub-sequence) and use it to calculate its distance to all sequences. The ordered vector is called the distance profile [37].  
**Definition 3**.: _A vector of the Euclidean distances \(D_{i}\) between a given sub-sequence and every other sub-sequence in the entire sequence \(T_{i,m}\) is called a distance profile \(D_{i}=[d_{i,1},d_{i,2},\ldots,d_{i,n-m+1}]\) between \(T_{i,m}\) and \(T_{j,m}\)[37]._We can consider a distance profile as a meta time-series that represents the time-series data \(T\) that is used to calculate it. Additionally, we should mention that it is assumed the distance is calculated by finding the Euclidean distance between either sub-sequences of a data series or Z-normalised sub-sequences of a data series [37].  
The distance profile is zero at the location of the query if the query and all sub-sequences belong to the same time-series data; this is known in the literature as a trivial match in the time series. These trivial matches can be removed or excluded, as will be demonstrated in detail later in this paper. The distance profile is close to zero before and after the location of the query. Since this paper is about finding anomalies in network traffic (DDoS attacks), we do not discuss finding patterns in detail; it is mentioned in this paper only for the sake of completeness.  
The Euclidean distance is the difference between any two points in so-called Euclidean space. It is also sometimes called the Pythagorean distance because it is calculated using the Pythagorean theorem. The distance between points \(q\) and \(p\) in Figure 1 can be calculated using the simple formula \(d(p,q)=|p-q|\), or it can be calculated using the Pythagorean theorem, as follows: \(d(p,q)=\sqrt{(p-q)^{2}}\)[38].  
In the figure, \(a=q_{1}-p_{1}\) and \(b=q_{2}-p_{2}\).  
\[d(p,q)=\sqrt{\sum_{i=1}^{n}(q_{i}-p_{i})^{2}}. \tag{1}\]  
The matrix profile algorithm can use time-series data to calculate the Euclidean distance by Equation (1), or it can use Z-normalised time-series to calculate the Euclidean distance using Equation (4). To calculate Euclidean distance for Z-normalised time-series data, the mean \(\mu\) and standard deviation \(\sigma\) must be calculated. Equations (2) and (3) are used to calculate the Z-normalised \(p\) and \(q\).  
\[\hat{q_{i}}=\frac{q_{i}-\mu_{q}}{\sigma_{q}}, \tag{2}\]  
\[\hat{p_{i}}=\frac{p_{i}-\mu_{p}}{\sigma_{p}}, \tag{3}\]  
where \(\mu_{q}\) and \(\mu_{p}\) are the average and \(\sigma_{q}\) and \(\sigma_{p}\) are the standard deviation of data \(q\) and \(p\), respectively.  
\[d(p,q)=\sqrt{\sum_{i=1}^{n}(\hat{q_{i}}-\hat{p_{i}})^{2}}. \tag{4}\]  
**Definition 4**.: _Define P as matrix profile of time-series \(T\), which is the Euclidean distance between each subsequent \(T_{i,m}\) and the closest match in time series \(T\), in other words, its nearest neighbour. Therefore, we can define P as \([min(D_{1}),min(D_{2}),\ldots,min(D_{n-m+1})]\)[40]._  
Figure 1: Euclidean distance between two points.