## 5 Proposed Taxonomy of the Attacks, DDoS Attacks, and DDoS Detection Approaches on CC
### Taxonomy of DDoS Attack Detection Approaches on CC
#### 5.3.5 Filtering Tree-Based Detection
Suppose an attack successfully shutts down the server; the CSQD system will detect the malicious requests and store them in its database to prevent similar attacks in the future. The authors presented a game-theoretic model and study that predicted widespread strategy adoption, reducing the risk of DNS amplification attacks. They have demonstrated the ability to implement their concept as a CC-based service to cut costs further and provide additional defenses for DNS servers. A new solution dubbed an enhanced DDoS-mitigation system (Enhanced DDoS-MS) has been developed to combat EDoS attacks by leveraging firewall capabilities to control a verification process to protect the targeted system. Researchers used a simulated environment to assess their proposed system, showing the firewall successfully mitigates DDoS attacks by increasing users' services in response time and server load under attack [149; 150]. [PERSON] et al. [151] proposed a simplified CC security utilizing ML approaches to address the challenge of complex and platform-specific CC security architectures. It leads to a more general design that employs decision trees and neural networks as classifiers, trained using data gathered by CC apps. [PERSON] et al. proposed a multilevel thrust filtration (MTF) mechanism as a solution against DDoS attacks in a CC environment. The mechanism authenticates incoming requests and detects various types of DDoS attacks at various levels at the early stage to prevent unnecessary traffic from reaching the DC [152]. Tables 16 and 17 list some of the existing DDoS attack detection approaches on CC based on the filtering tree technique. \begin{table}
\begin{tabular}{p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt}} \hline
**Refs** & **Detecting OSI Layer** & **Feature Selection** & **Features Used** & **Parallel Processing** & **Algorithm Used** \\ \hline
[153] & L7 & Unknown & IP; SOAP header, URL & Unknown & Unknown & ✗ & Hop count filter \\
[154] & L7 & Unknown & threshold logic unit (TLU), IP address, HTTP Request, IP header & Generic new real-time data & ✗ & DPM, neural network (NN) \\
[155] & L7 & Unknown & IP; Session such as Session ID, Port, CPU Processing Time such as Average Processing Time for accessing the resource, Processing Time for request & KD Cup 2000 & ✗ & decision tree algorithm \\
[148] & L7 & Unknown & IP; ID, date Time-consuming, URL, Request List, content, requested URL & Linkover & ✗ & CSQD \\
[156] & L7 & Unknown & IP, cookie, Time to Live (TTL), number of requests & CIDR notation & ✗ & Filter, game-theoretic model \\
[150] & L7 & Unknown & IP address, TTL value, HTTP requests, response time, average load level & Unknown & ✗ & graphical Turing Test (CAPTCHA) \\
[151] & L7 & Unknown & Unknown & Collect access logs from multiple web applications & ✗ & 48 decision trees, neural networks \\
[152] & L3,7 & Unknown & IP; ID client, ID request, password, session, type of incoming request, MAC address, request size, timestamp & Unknown & ✗ & MTF \\ \hline \end{tabular}
\end{table} 
Table 16: DDoS attack detection approaches based on filtering tree.