## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.6 Machine Learning-Based Detection Methods
Each pole was fitted with Raspberry Pi 3, which oversaw gathering of the sensor data because it can communicate with Ethernet, Bluetooth, ZigBee (via the I\({}^{2}\)C protocol), and Wi-Fi devices as a heterogeneous gateway. Figure 14: A typical experimental setup for DDoS attack detection machine: (**a**) architecture of the smart pole, (**b**) multi-layer IoT architecture, adapted from [139]. The IoT gateway gathered and pre-processed sensor data packets. As part of the procedure, DT classifiers were trained using the extracted packet attributes, such as packet length, timestamp, protocol, source IP and MAC, and destination IP and MAC, based on the types of DDoS attacks. The classifier determined whether packets are normal or anomalous. It is thought that, in normal conditions, sensors send data at a set frequency; however, in attack scenarios, hackers infect IoT devices and control the sensors, causing them to send data continuously. To determine whether the IoT devices are in a normal state, a timestamp is chosen for the sensor data, and an estimation of the total number of packets for a set period is made. Since ICMP packets are typically sparse on the network, it is simple to detect ICMP attacks. Therefore, receiving many ICMP packets quickly indicates that a device has been compromised. Experimental results show that ICMP flooding, SYN flooding, and UDP flooding were detected with 97.39% accuracy and an F1-score above 97%. The gateway alerts the user as soon as it identifies the flood of sensor data attacks. The SDN controller equipped with the RT166P SDN switch is used to blacklist the compromised device so that IP and MAC addresses from such devices are blocked and network traffic is restricted. Blacklisting compromised devices is performed by the SDN controller via bandwidth control and port mirroring. In port mirroring, a switch sends a copy of every packet received on one port to another port, which is used to store the packets and analyse the data. The bandwidth in the mirror port, which gathers all packets from the eight smart poles for varying numbers of malicious devices that perform DDoS attacks on the Internet, is then examined. The outcome demonstrates that, in an attack-free environment, the mirror port's capacity is approximately 10 Mbps, whereas a single UDP flood records a bandwidth between 80 and 100 Mbps. Therefore, the bandwidth control rule of the SDN switch was set to 800 Mbps to prevent devices from entering overload status when attackers conduct a significant DDoS attack. For a huge DDoS attack, the bandwidth is predicted to be in the range of Gbps or even Tbps. [PERSON] et al. [140] presented an attack detection and mitigation architecture for IoT networks using machine learning. In this study, a multi-class classifier was developed using DT, RF, k-NN, multi-layer perception (MLP), RNN, and LSTM to classify the extracted features from the BoT-IoT dataset. This classifier follows the looking-back idea, where the sub-categories of the attacks are also localized. Evaluation results show that looking-back-enabled RF has the highest accuracy, while the lowest is observed with the k-NN under the same concept. The authors of [141] implemented k-NN, SVM, NB, DT, RF, and LR machine learning algorithms in WEKA tools to analyse their detection performance using the CICDDoS2019 datasets. Evaluation results show that both DT and RF record the highest accuracy, while the NB has the lowest detection accuracy. Nevertheless, the DT has superior performance in terms of processing time. The DT classifier requires 4.53 s to process the data, whereas the RF classifier needs roughly 84.2 s. Similar to the earlier studies in [141], the authors of [142] analysed the potential of SVM, MLP, DT, and RF classifiers for attack detection in a simulated SDN environment using Scapy tool with a list of valid IPs. Results show the superiority of the RF over other classifiers in terms of detection accuracy. The DT, however, has a quicker processing time.