## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.6 Machine Learning-Based Detection Methods  
This approach involves the use of algorithms to identify malicious traffic from a pool of network traffic simply by learning the characteristics of the network traffic. After learning the characteristics of traffic features, these algorithms may develop an extremely accurate model for identifying these features. Several machine learning algorithms are employed for attack detection. In this section, we investigate attack detection studies in the IoT and some other emerging networks. _Attack detection in IoT and SDN using machine learning:_ The research work discussed in [22] demonstrates the use of ANN for DDoS attack detection. Based on distinctive patterns that distinguish DDoS attacks from normal traffic, the ANN can identify TCP, UDP, and ICMP DDoS attacks. The efficacy of the approach was compared to backpropagation (BP), Chi-square, SVM, and Snort based on accuracy, precision, and sensitivity. The results demonstrate that it outperforms its competitors (BP, Chi-square, SVM, and Snort), with a detection accuracy of 98% attained. Additionally, the method records a precision value of 100% and a sensitivity value of 96%. As the accuracy only totals 98%, the precision value of 100% still needs further substantiation. This method has a significant flaw in that it cannot detect DDoS attacks when the protocol headers are encrypted using any encryption scheme. [PERSON] et al. [131] suggested employing SVM to detect attacks in an SDN-based network. This method involves the routine collection of network packets, from which 24 features are extracted. SVM is then used to categorize these features and find abnormalities. The method was validated through the NSL-KDD dataset, and its performance was compared to that of the J48 and Naive Bayes (NB) classification methods. The approach has a detection accuracy of 99.4%, compared to 99.75% and 95.87% for the J48 and NB algorithms, respectively. It can be shown that the J48 classification method continues to perform better in terms of accuracy than the suggested approach. The method also has a significant processing overhead. The study in [132] uses SVM to classify additional traffic features that are periodically obtained from a flow table. These are aggregated features that pertain to DDoS attacks. They include the speed of the source IP and port, the speed of flow entries, the standard deviation of the flow bytes and packets, and the ratio of pair-flow. The validity of the approach was verified by simulation. Evaluation results show that a detection rate of 95.24% was achieved, even with a small amount of flow data. The method does, however, record some false alarms. The average false alarm rate generated was 1.26%. The effectiveness of SVM and deep feed forward (DFF) algorithms for detecting DDoS attacks in IoT networks was examined in [133]. The effectiveness of these algorithms was analysed using the DARPA'09 dataset. Evaluation results revealed that DFF has superior accuracy to SVM. However, the SVM method outperformed the DFF algorithm in terms of processing time. The detection accuracy recorded by the DFF is 99.63%, compared to 81.23% for the SVM. This demonstrates that DFF performs roughly 22% better than SVM. The findings also showed that the DFF has a higher computational overhead, which has a big impact on its detection speed. [PERSON] et al. [134] designed an SDN framework and applied four machine learning classifiers independently for the detection and mitigation of ICMP and TCP floods. J48, RF, SVM, and k-nearest neighbours (k-NN) were the machine learning classifiers considered. In this approach, a synthesized dataset having normal and DDoS traffic with 24 packet-level features was employed to assess the effectiveness of the classifiers. Aside from DDoS attack detection, a mitigation code was also developed to restrict the attackers' switch ports for 30 s. Evaluation results show that the J48 classifier outperforms the other algorithms in terms of processing speed.