## 5 Proposed Taxonomy of the Attacks, DDoS Attacks, and DDoS Detection Approaches on CC
### Taxonomy of DDoS Attack Detection Approaches on CC
#### 5.3.2 Anomaly-Based Detection
The authors in [120] studied the existing DDoS attack detection frameworks and their flaws, then proposed a CC testbed framework on top of an OpenStack platform [121] for testing HTTP flood DDoS attack solution. They also looked into numerous attack paths to the web server on the CC, internally and externally. The authors present a novel approach to protecting mobile-based systems from DDoS attacks. The model is built on anomaly detection to defend the public/private CC against zero-day attacks. By preventing CC DDoS attacks, the availability of CC applications significantly improved, and users will receive high-quality services [122; 123]. Evaluations of the proposed model's efficiency and performance were promising in safeguarding mobile-based CC systems against DDoS attacks. The focus is on detecting and protecting mobile-based systems from DDoS attacks [124]. [125] reported the approach's complexity analysis, efficacy, and performance assessments, and the improved version is documented in [124]. [PERSON] and [PERSON] [33] proposed and developed a mechanism called TPANGND for detecting DDoS attacks based on anomalies. Their mechanism uses flow-based classifier (FBC) to group similar input patterns into several clusters to determine an attack. Unique scenarios exist where FBC cannot distinguish between benign and malicious traffic. The suspect traffic is recognized in this situation by looking at the correlation between the VM instance issued by the CSP at a specific timestamp and the suspicious source list. The experimental results show that the suggested technique has a higher detection rate than existing K-means, fuzzy c-means clustering, bat clustering, and Bartd methods. It can detect unknown threats with fewer false alarms [126; 127]. [PERSON] et al. [128] proposed a new framework to detect various EDoS attacks by creating a profile that learns from and categorizes normal and abnormal activities. The more demanding resources are only allocated to VMs with a normal state in this framework, preventing the propagation of attacks and resource misuse in the CC. [PERSON] et al. [129] proposed collaborative IDS (CIDS), a system that combines cascading decision trees (DTs) and SVM to increase detection accuracy. DT speeds up the learning process and divides the dataset into smaller subsets; SVM on each sub-dataset (e.g., KDD99, NSL KDD, and ITOC) reduces SVM learning time, overcomes over-fitting, and reduces the size of the DT, allowing faster detection. [PERSON] and [PERSON] [127] proposed a method that scans log files to extract essential information related to HTTP flooding threats by grouping similar input patterns using fuzzy bat clustering and determining unusual behavior using deviating anomaly scores. They compared the findings with existing methodologies such as k-means clustering, fuzzy c-means clustering, bat clustering, and the Bartd method, showing the proposed method accurately diagnoses anomalies with low false alarms. Tables 10 and 11 list some existing CC DDoS detection approach based on anomaly detection techniques. \begin{table}
\begin{tabular}{p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt} p{42.7 pt}} \hline \hline
**Refs** & **OSI Layer** & **Feature Selection Tool** & **Features Used** & **Parallel Processing** & **Algorithm Used** \\ \hline
[114] & L7 & Unknown & End-time, start-time, status, request-response pair, SessionID Uses the same features as [130; 131] source IPs, packet size, No. of sources, packet rate, Linux kernel features, Number of requests. HTTP-GET HTTP status codes, Linux kernel features, and CPU time. Load, protocol distribution of the network service, information of the packet header, packet size, the maximum value, flow monitoring utilizing a spoofing address, Request URL, IP address of the remote host, CPU usage, minimum value of traffic, The time of the request & Random dataset (unknown) & ✗ & NA \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Anomaly-based Detection approaches.