## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.3 Statistical-Based Detection Methods
[95] used the ARIMA framework to identify DDoS attacks via the NS2 simulator. [PERSON] et al. [96] introduced a novel algorithm with the use of the ARIMA technique to detect possible attacks that may occur in computer networks. Their approach offers the network administrator a means for early warning. In [97], a combination of ARIMA and a chaotic system was used to detect attacks, with a true positive rate of 94.4%. Additionally, false positives and false negatives of 0.1% and 5.6%, respectively, were recorded. The authors in [98] looked at the relationship between the average and standard deviation of the network traffic throughput to evaluate DDoS attacks. The research demonstrates that, in non-attack situations, the rise in standard deviation caused by a traffic surge increases the average network throughput, as seen in Figure 13. However, in a DDoS attack scenario, the standard deviation is not affected by the increased network throughput because of the attack. This hypothesis was used to produce an attack detection method with linear regression. The efficacy of the developed approach was confirmed using the CAIDA dataset. The results obtained revealed that DDoS attacks may be accurately identified with a low proportion of false positives. In [99], the authors used several forecasting algorithms, including MA, WMA, EWMA, and LRM, to predict the intensity of SYN, DNS, and ICMP floods. For the predictions in this study, a window size of 60 s was established to track the number of packets. The results for the three attack types demonstrate that LRM best detects the magnitude of TCP-SYN flood, while EWMA is best at detecting the attack intensity of DNS, TCP and ICMP floods. The algorithms are said to produce an overall error rate of 1%. The research studies presented have shown that forecasting models can be used for attack detection with a relatively high level of accuracy. The inherent errors generated by these models are a significant disadvantage. Every forecast model generates a succession of errors between the predicted and overserved values. Accordingly, if the network traffic data contains one forecast for each feature, then the total errors from all the features amount to the following:  
\[e_{T}=\frac{1}{n}\sum_{i=1}^{n}e_{i} \tag{22}\]  
where \(e_{i}\) is the error generated by the n-feature. Therefore, significant forecast errors are anticipated, given the intermittent nature of internet traffic. In addition, because the models depend on prior statistical features, they may not work well with actual internet data series [100]. Other statistical approaches are also reported in the literature. These range from the use of a simple \(t\)-test to a more sophisticated cumulative sum (CUMSUM) approach. Figure 13: Correlation between the mean and standard deviation of traffic throughput, adapted from [98]. Additional reported techniques are the statistical segregation method (SSM), multivariate correlation analysis (MCA), and analysis of covariance, among others. In the two-sample \(t\)-test proposed by [PERSON] [101], the authors examined the statistics of the normal SYN arrival rate (SAR) by sampling the input traffic flow. Then, the dissimilarity between the number of SYN and ACK packets as well as the dissimilarity between the arriving SAR and normal SAR are estimated to ascertain the occurrence of an attack. Simulation results revealed that the proposed method has a quick detection rate and a low likelihood of both false positives and false negatives. Additionally, computational overhead is not too high and, in the event of a sudden shift in traffic, can detect DDoS flood attacks. In low-traffic areas, it might, however, miss an attack. The CUMSUM method estimates the cumulative sum of the difference between an input sequence's actual and expected values, which is then compared to a threshold value [102]. A CUMSUM value above the threshold signifies a change in statistical features in the network traffic over time series. This method is used to estimate variations in traffic features.