## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.7 Deep Learning-Based Detection Methods
The authors of [176] investigated a framework for attack detection in FANETutilizing recurrent neural networks. The framework has both the data collection and the data stream processing modules. The latter gathers communication data from the drones, including data relevant to intrusion detection, which is subsequently put into two RNN modules for data processing. The efficacy of the proposed approach was verified using the KDD Cup'99, NSL-KDD, UNSW-NB15, Kyoto, CICIDS2017, and TON_IoT datasets. The results showed that the framework has excellent performance. In [177], a deep convolutional neural network (DCNN) was utilized for attack detection in UAV networks. This method made use of encrypted wireless traffic records that were gathered from three different types of frequently used UAVs: DJI Spark UAVs, Parrot Bebop UAVs, and DB Power UAVs. The performance of the proposed approach was demonstrated using the UAV-IDS-2020 dataset, which has numerous attacks against UAV networks. Experimental results show that a detection accuracy of 99.50% was achieved with a 2.77 ms prediction time. The authors of [178] concentrated on crystal structure optimization for attack detection in the IoD environment using a deep autoencoder-based model. In this work, the feature subsets were selected using a modified deer hunting optimization-based feature selection strategy, and the attacks were classified using an AE method. The model was simulated, and the results obtained showed that an accuracy of 99.12% was achieved. However, the proposed model needs to be tested on a large-scale, real-time dataset. [PERSON] et al. [179] developed an open-CNN model for the detection of unknown attacks in drone networks. Extensive experimental demonstrations showed that the developed model could detect DDoS, DoS hulk, botnet, and web attacks when tested on the CICIDS 2017 dataset. In addition, the authors compared the performance of the developed model with CNN and CNN-LSTM. The results presented revealed that the accuracy was improved by 9-30% when compared to the CNN and CNN-LSTM models. _Attack detection in RPL-based IoT using deep learning:_ A framework that employs stacked AE-based DNN for CID attack detection in RPL-based IoT networks was proposed by [PERSON] et al. [180]. To create a dataset for this study, CID attacks were implemented using the Cooja network simulator, considering three different network structures with a number of benign and malicious nodes. The SAE + DNN model was used to process and categorize these data. Experimental results showed that the framework detects CID attacks with an average accuracy of 99.65%. The proposed framework, however, is only capable of detecting CID attacks and cannot be utilized to identify other types of attacks in RPL-based IoT networks. Additionally, more computational overhead is observed, which is not good for resource-constrained IoT devices. In [181], an ANN-based attack scheme was proposed, using MLP for attack detection in an RPL-based IoT network. The proposed approach has three stages: simulation, pre-processing, and classification. In the simulation stage, packet data are generated from the Contiki network simulator; the features of these data are extracted during pre-processing, while the classification stage involves the application of the MLP to the extracted features to identify attacks. Simulation results show that the approach could identify a VN RPL attack. Additionally, the method records a root mean square error (RMSE) of 0.0003 and a mean absolute error (MAE) of 0.0002. This study does not cover other well-known performance metrics such as accuracy, precision, recall, and F-measure. Additionally, the method has a higher computational burden, which could restrict its application to constraints devices. In [PERSON] et al. [182], a deep learning approach to detect hello flooding attacks in RPL was presented, using a gated recurrent unit (GRU) network with RRN.