## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.3 Statistical-Based Detection Methods  
This approach analyses the statistical features of normal traffic to create a baseline traffic pattern. Any incoming traffic that falls outside the baseline is judged to be malicious traffic. This approach processes network traffic using sophisticated statistical algorithms and differentiates anomalous traffic from legitimate patterns of established network traffic. With the statistical technique, expected behaviour can be inferred from observations without any prior knowledge of the target system's typical operations. This can potentially lead to more accurate detection of malicious activity. Statistical algorithms used for DDoS attack detection may include, among others, statistical forecasting and time series methods, as shown in Figure 8.  
_Chi-squareapproach:_ The Chi-square (\(\chi^{2}\)) is a test of independence used to determine if two categories of variables are connected to one another. Given the overall frequency of each category, it looks for patterns in these observations to determine whether any combinations of the categories occur more frequently than would be predicted by chance. A very small value of \(\chi^{2}\) indicates a good correlation between the actual and expected values, whereas a large value implies that the actual values do not closely match the anticipated values. This approach has been used in several research studies [86, 87, 88, 89] for anomaly detection in internet-based networks. Ref. [86] tested it to assess the prevalence of TCP-SYN flag values and protocol numbers. In method in this study, service ports are examined using the Chi-square method while considering HTTP, FTP, and DNS. Similarly, packet lengths are binned into ranges. If there are \(N\) numbers of incoming traffic packets while \(B\) represents the available bins, the amount packets with values within the \(i^{\text{th}}\) bin is represented by \(N_{i}\), and \(n_{i}\) denotes the anticipated number of packets in this bin based on the usual distribution. Thus, \(\chi^{2}\) is estimated using (21):  
\[\chi^{2}=\sum_{i=1}^{B}\left(\frac{(N_{i}-n_{i})^{2}}{n_{i}}\right) \tag{21}\]  
[PERSON] and [PERSON] [87] used the same expression for attack detection by analysing RST, SYN, ACK, and ICMP packets. The proposed method consists of a database storage block, a Chi-square test block, a feature extraction and distribution block, a distribution and categorization block, and a decision-making block, as shown in Figure 12.  
Firstly, TCP flags are extracted for each input packet from the network traffic dataset. Under the data distribution and categorization block, packets are distributed and categorized into the number of RST, SYN, ACK, and ICMP packets per second, along with other TCP packets. After categorization, a Chi-square approach is employed to carry out anomaly detection, where a \(\chi^{2}\) value is estimated using (21) and compared to a tabular \(\chi^{2}\) value. When there is a large difference between these two values, an intrusion alert is triggered. Figure 12: Framework for DDoS attack detection using Chi-square approach. [PERSON] and [PERSON] [88] used the goodness-of-fit test of the \(\chi^{2}\) approach to detect attacks. The method examines the number and variation of packets sent from sources, as well as IP address distribution statistics. When an attacker floods the system with many packets from random source IPs, the approach estimates its Chi-square value and checks to see if it exceeds a predetermined threshold to trigger an attack alarm. Experimental findings demonstrate the approach's capability to quickly identify DoS and DDoS attacks. Other studies reporting the use of \(\chi^{2}\) value for attack detection may be found in [89]. In [89], \(\chi^{2}\) was estimated based on moving averages while considering how frequently events appeared in the Solaris BMS audit record. The results obtained showed that the \(\chi^{2}\) values based on the moving average were sufficient to detect anomaly attacks.