## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.7 Deep Learning-Based Detection Methods
Similar to the studies presented in [181], the approach also consisted of three stages: network simulation, pre-processing, and detection. The network simulation made use of the Contiki-Cooja simulator to generate datasets, which were processed and fed to the input of the GRU + RNN to differentiate between legitimate and malicious nodes. The performance of the proposed model was verified using five and four feature sets. According to the results, an accuracy of 99.96% was attained for the five-feature set and 99.90% for the four-feature set. Additionally, a mean square error of 0.05 was achieved. Similar to the research presented in [181; 182], the authors in [183] used an MLP classifier to distinguish between normal and malicious behaviour using a dataset generated from the Cooja simulator. Hello flooding, VN, and decreased rank (DR) attacks were all included in this dataset. Results from the simulation indicated that a 99.5% accuracy rate was attained. Additionally, according to the F1-score results, the approach has a detection rate of 94.7%, 99%, and 95% for DR, HF, and VN attacks, respectively. Analysis of other critical parameters, such as end-to-end delay and processing times, may also need to be investigated. Additionally, the used traffic data are static and do not accurately reflect the dynamic nature of internet traffic. _Attack detection in NDN using deep learning:_ [PERSON] et al. [184] proposed a scheme based on CNN for detecting FLA in NDN. In this study, the regularity of previous requests was harnessed, and the inherent features of the cached contents, such as the request ratio, the standard deviation of repeated interests, the variance of the request interval, and the change in cache hit ratio, were used as input data to the CNN. CNN was able to classify the attacks and report whether an attack had been executed. The scheme was simulated using different network topologies, and the results revealed that the scheme is effective in detecting FLA with a detection ratio of 26.3% and a cache hit ratio of 12.2%. It also records a lower hop count. Unlike previous solutions, the authors in [154] developed a hybrid multi-objective strategy employing optimization and a deep learning model for DoS attack detection in NDN. This was accomplished by merging the multi-objective evolutionary optimization technique with particle swamp optimization, while the prediction accuracy was improved using the radial basis function (RBF) neural network. When malicious traffic is recognized, the router notifies the source interfaces. The performance of the hybrid scheme was demonstrated in a simulated environment consisting of different network topologies. Evaluation results showed that the scheme can respond to and mitigate DoS attacks with good accuracy. An accuracy of more than 90% was recorded in terms of the average interest satisfaction ratio for legitimate users, the PIT usage, and the number of received contents. Moreover, a very low false positive rate was achieved. A feature analysis of detection parameters was not discussed in this study. Similar to the study presented in [154], [PERSON] et al. [185] applied deep learning models for IFA detection in NDN using linear and DFN network topologies in the ndnSIM and CCNx code bases. These simulated network topologies were used to generate the dataset, which was then used on MLP with back propagation (MLP + BP) and RBF with computed k-means clustering. In addition, the RBF was combined with other optimization algorithms such as PSO (RBF + PSO), RBF + JAYA, and teaching learning-based optimization (RBF + TLBO). To localize the IFA attacks in the dataset, SVM and k-NN classifiers were also created individually, and the effectiveness of these techniques was evaluated. According to experimental findings, MLP + BP, RBF + PSO, RBF + JAYA, and RBF + TLBO have more accurate detection than k-NN and SVM. The MLP + BP offers the highest precision (97.5%) and accuracy (97.3%) while using CCNx code. Additionally, a few instances of false alarms were noted.