## 5 Proposed Taxonomy of the Attacks, DDoS Attacks, and DDoS Detection Approaches on CC
### Taxonomy of DDoS Attack Detection Approaches on CC
#### 5.3.1 Signature-Based Detection  
Signature-based, misused-based, or rule-based approaches detect a DDoS attack if the incoming packets or traffic patterns match the predefined signatures or rules in its attack signatures database [105]. The drawback of these approaches is they cannot detect zero-day attacks. The authors in [106] outlined the design of an offline signature-based network IDS that uses distributed processing and a Naive Bayesian classifier to detect DoS and DDoS attacks against HTTP servers. They or other researchers should do more work to build an inline IDS to identify attacks in real time. Because the current technique can only detect known attacks, more research is needed to detect new ones. The performance of the Naive Bayesian classifier, having different classification methods, was evaluated on a testbed, achieving 97.82% classification accuracy for slow read attacks and 96.46% detection accuracy for normal behavior. [PERSON] and [PERSON] [107] attempted to solve the problem of HTTP and XML Denial of Service (HX-DoS) attacks using CLASSIE, a rule-based detection system, and the modulo marking approach, which prevents spoofing attacks. For decision and packets dropping on the victim side, the Reconstruct and Drop method is employed. It helps improve the detection and filtering of DDoS attacks while lowering the false-positive rate. These attacks can be quickly detected on the adversary side by utilizing a packet-based marking mechanism. It can be filtered using the discovered packets on the victim side by dropping the marked packets. As a result, the overhead of packet marking and the false-positive rate of DoS attacks are considerably decreased. [PERSON] et al. [12] presented a dataset shift attack detection system based on a graphic model. The simulation findings suggest that their architecture can deal with the security difficulties posed by the new network paradigm effectively and efficiently. Additionally, the simulation result indicates that their attack detection system can effectively report numerous threats using real-world network traffic. They proposed a new IPS service that uses signature-based devices, known as service-based intrusion prevention systems in CC (SIPSCC), to prevent SQL injections on CC websites (CCW). They used three VMs to test a model. Their implementation proposes, investigates, and evaluates SIPSCC from three perspectives: vulnerability detection, average time, and false positives. The suggested technique identifies and prevents key vulnerabilities in CCW [108]. [PERSON] and [PERSON] [109] proposed an architecture that includes the implementation of Suricata IDS for securing virtualized servers on CC and the validation of the IDS in detecting DDoS attacks against virtualized environments, effectively protecting the CC from vulnerabilities. \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**Refs/Year** & **Dataset Name** & **Sort of Traffic** & **OSI** & **OSI** & **OSI** \\  & & & **L3** & **L4** & **L7** \\ \hline
[98]/2014 & Booter & DNS & ✗ & ✗ & ✗ \\
[96]/2014 & FRGPS SDP & SSTP, UDP, ICMP & ✓ & ✓ & ✗ \\
[99]/2015 & UNSW-NB15 Coburg Intrusion Detection Dataset & TCP & ✗ & ✓ & ✗ \\
[100]/2017 & CIDDS-001 CIDDS-002 & ICMP, TCP, UDP, HTTP & ✓ & ✓ & ✓ \\
[101]/2017 & CICIDS2017 & HTTP/S, SMTP, POP3, IMAP, SSH, FTP & ✗ & ✗ & ✓ \\
[97]/2018 & DITLBRoot - 20180410 & DNS & ✗ & ✗ & ✓ \\
[102]/2018 & CSE-LCIC-IDS2018 on AWS & HTTP/s, SMTP, POP3, IMAP, SSH, FTP & ✗ & ✓ \\
[103]/2019 & CICDDoS2019 & DNS, TFTP, WebDDoS, etc. & ✓ & ✓ & ✓ \\
[104]/2020 & AIT Log Data Set & WebServer, WebMail, smtp, etc. & ✗ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 7: _Cont._[PERSON] et al. [110] proposed combining a multi-threaded network IDS (NIDS) and host IDS (HIDS) to provide an efficient, quick, and secure HIDS. Cloud-IDS now captures packets from the network, analyses them, and sends reports to the CC Administrator based on the analysis. The K-Nearest neighbor and neural network (KNN-NN) hybrid classifier analyze packets.