## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.6 Machine Learning-Based Detection Methods
\begin{table}
\begin{tabular}{p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt}} \hline \hline
**Study** & **Method Used** & **Description** & **Dataset** & **Application Domain** & **Remarks** \\ \hline \multirow{9}{*}{[13]} & \multirow{9}{*}{RF, k-NN, MLP, LR, DT, SVM, NB} & \(\bullet\) & Gathers sequence of GPS signal characteristics from UAV setup. & & \(\bullet\) & Detection of GPS spoofing attacks in UAV networks was achieved. & \\  & & \(\bullet\) & UAV is subjected to spoofing attacks using an SDR transceiver module. & Synthesized & FANET & \(\bullet\) & Gives a detection rate, misdetection rate, and false alarm rate of 92\%, 13\%, and 4\%. \\ \hline \multirow{9}{*}{[131]} & \multirow{9}{*}{SVM} & \(\bullet\) & Collect network packets periodically. & & \(\bullet\) & Achieves a detection accuracy of 99.4\%. \\  & & \(\bullet\) & Classify the features using SVM. & & \(\bullet\) & High computational overhead. \\ \hline \multirow{9}{*}{[139]} & \multirow{9}{*}{DT} & \(\bullet\) & Capture sensor data packets via IoT gateway. & & \(\bullet\) & ICMP flood, SYN flood, and UDP flood are detected with 97.39\% accuracy. & \\  & & \(\bullet\) & Data are used to train a DT classifier. & & IoT & \(\bullet\) & F1-score above 97\% is achieved. \\ \hline \multirow{9}{*}{[144]} & \multirow{9}{*}{RF, DT, k-NN and XGBoost} & \(\bullet\) & Apply feature selection approach on four classifiers to assess the detection accuracy. & & \(\bullet\) & XGBoost with ANOVA has the superior performance, with an accuracy of 98.35\%. \\ \cline{3-6}  & & \(\bullet\) & A hybrid of LR and RF was utilized to address security concerns with IoT-enabled drones. & & \(\bullet\) & Records an accuracy of 98.58\%. \\ \hline \multirow{9}{*}{[145]} & \multirow{9}{*}{LR and RF} & \(\bullet\) & A hybrid of LR and RF was utilized to address security concerns with IoT-enabled drones. & & \(\bullet\) & Precision, recall, and F-measure values of 97.68\%, 98.59\%, and 99.01\% are recorded. \\ \cline{2-6}  & & \(\bullet\) & Model SYN traffic using Bayesian inference. & & & \(\bullet\) & Detects SYN flooding, Hello flooding, RREQ, and UDP flooding. \\ \cline{1-1}  & & \(\bullet\) & Develop an algorithm to identify SYN flood attacks. & DARPA’99 & PANET & \(\bullet\) & Has high true positive and precision level. \\ \hline \multirow{9}{*}{[147]} & \multirow{9}{*}{Agent-base and DT} & \(\bullet\) & A multi-agent and DT-based machine learning approach was developed for attack detection. & & \(\bullet\) & Detects unknown and known DoS attacks. \\ \cline{1-1}  & & \(\bullet\) & Investigate the effectiveness of machine learning classifiers for Sybil attack detection. & & \(\bullet\) & Has low false positive and negative rates. \\ \cline{1-1} \cline{2-6}  & & \(\bullet\) & Investigate the effectiveness of machine learning classifiers for Sybil attack detection. & & \(\bullet\) & NB has the best performance with 92.14\% accuracy. & \\ \cline{1-1} \cline{2-6}  & & \(\bullet\) & Propose a framework for VAN attack detection using LGBM. & Simulated & RPL-based IoT & \(\bullet\) & Anieves 99.6\% accuracy. \\ \cline{1-1} \cline{2-6}  & & \(\bullet\) & Propose a framework for VAN attack detection using LGBM. & & \(\bullet\) & Precision of 99.6\%. \\ \cline{1-1} \cline{2-6}  & & \(\bullet\) & & & IoT & \(\bullet\) & Only one attack can be detected. \\ \cline{1-1} \cline{2-6}  & & \(\bullet\) & & & \(\bullet\) & Large computational overhead. \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Summary of studies on the application of machine learning models for DDoS attack detection.