# A Review on Hot-IP Finding Methods and Its Application in Early DDoS Target Detection
## 1 Introduction  
In network monitoring and attack detection applications, the collection and processing of data packets passing through the network is a big challenge because the number of transferred packets is huge, especially on high-speed connections. In addition, apart from the processing of information items in packet headers, many applications also need to process the packet payloads. This causes significant delays in the processing of data packets and can result in network traffic congestion. Therefore, it is necessary to select suitable packet information items and appropriate processing methods to speed up the processing of data packets. In an IP (Internet Protocol) packet header, the source IP and destination IP are important information for the transfer of the packet from the source host to the target host. In DDoS (Distributed Denial of Service) attacks, a huge number of packets of fake requests are sent to the target host to exhaust system resources or to flood the network connection. Since the destination IP of these packets is the attacked target host, it is possible to detect a DDoS attack in the early stage by monitoring high-frequency destination IPs in the target network router. Similarly, the monitoring can be done in ISP (Internet Service Provider) routers to track source IPs of hosts that originate a large number of packets. These IPs may be the addresses of hosts infected with network worms and these worms are scanning the network for the next target hosts. IP addresses with a high occurrence frequency in the IP packet stream are called Hot-IPs. Therefore, the problem of target detection of DDoS attacks or the detection of network worm sources can be solved by monitoring the IP packet stream transferred through the network to find Hot-IPs [1; 2; 3]. On a certain network connection, an IP packet stream is a sequence of IP packets, which can be represented as \(S=\{a_{1},a_{2},\ldots,a_{M}\}\), where there are \(M\) packets with \(N\) unique IP addresses. Supposeto be the occurrence frequency of the packet with IP address \(s_{i}\) in \(S\), and then we have \(f_{i}=\{j\,|\,s_{j}=s_{i}\}\), where \(1\leq i\leq N\) and \(1\leq j\leq M\). We also have \(f_{1}+f_{2}+\ldots\,+f_{N}=M\) and, given the occurrence frequency threshold \(\varphi\), the Hot-IP = \(\{s_{i}\,|\,f_{j}\geq\varphi\}\)[1,2]. The problem of finding Hot-IPs in the IP packet stream can be solved using algorithms for finding elements with a high occurrence frequency in the data stream. There are a number of such algorithms, including Majority, Frequent, Lossy Counting, Space Saving, Count-Sketch, Count-Min and Group Testing [4; 5; 6; 7; 8; 9; 10; 11; 12]. Section 2 of this paper will briefly discuss these algorithms. [PERSON] et al. [1,2] proposed to use the non-adaptive Group Testing method for fast finding of Hot-IPs in the IP packet stream and to apply the results in the detection of DDoS attacks and network worm spreading sources. Since the computational complexity of the Group Testing method (O(\(t\)N), where \(N\) is the number of unique IP addresses and \(t\) is the number of tests) is relatively high, it is not efficient for the processing of the IP packet stream in heavy traffic [1]. To solve this issue, they use the [PERSON] code concatenation method to construct the \(d\)-disjunct matrix \(m\)[1,2]. Thus, the storage space of matrix \(m\) is significantly reduced and the computational complexity is also reduced, which is equivalent to the polynomial time. In this paper, we evaluate methods to find high-occurrence-frequency elements in the data stream and apply them to find Hot-IPs in the IP packet stream passing through the network. Based on the computational and space complexity evaluation results of each method, the most efficient method is selected for use in the target detection model of DDoS attacks. The rest of the paper is organized as follows: Section 2 reviews and compares methods for finding high-occurrence-frequency elements in the data stream and applies them in finding Hot-IPs in the IP packet stream.