## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.2 Queue Modelling-Based Detection Methods  
In this approach, a multidimensional algorithm is used to analyse how networking components process traffic based on traffic theory. Since DDoS attackers aim to engulf servers' resources and prevent legitimate clients from accessing them, a good queue management algorithm enables the system to manage access to a fixed amount of bandwidth by identifying which packets should be transferred and which ones should be dropped when the queue limit is fully occupied. In the queuing model, the memory of a server is assumed to be fixed [74]. It is then easy for an attacker to launch the attack and somehow disable the server, preventing it from providing the service to its legitimate user. A simple queue system is illustrated in Figure 11.  
In Figure 11, \(\lambda\) represents the arrival rate of packets at the queue, with a waiting time of \(W\), until they receive no response from server M, while \(\mu\) indicates the system's service rate. This system is based on [PERSON]'s law [75], which is expressed as shown:  
\[L=\lambda\times W \tag{18}\]  
The expression in (18) describes the average number of packets in a queue. DDoS attacks try to clog up the system's queue so that legitimate users cannot obtain service. By imposing sophisticated computational processes on the victim device, DDoS attacks can extend the time it takes to process packets or increase their service rate [76]. This attack scenario can be evaluated using queueing theory, which estimates the likelihoods of  
Figure 11: A simple queue system. bandwidth, memory, and CPU exhaustion. In [77], the probability of bandwidth exhaustion \(P_{b}\) is represented by a M/G/K/K queue model. In this model, \(P_{b}\) is estimated using (19) [77]:  
\[P_{b}=\frac{\frac{\rho_{b}^{k}}{k!}}{\sum\limits_{j=0}^{k}\frac{\rho_{j}^{k}}{ \
u!}},\quad\rho=\frac{\lambda_{b}}{\mu_{b}} \tag{19}\]  
In (19), \(k\) indicates the number of communication channels between the attacker and the target server, \(\lambda_{b}\) is the arrival rate of packets, which determines the attack intensity, \(\mu_{b}\) indicates the service rate, and \(\rho\) denotes the utilization factor for the queue system. When the DDoS attack exhausts the CPU of the target server, the probability of CPU consumption is represented by a simple M/M/1 queue model, described by (20) [77]:  
\[P_{C}=\left\{ \begin{array}{ll}1,&\frac{\lambda_{c}}{\mu_{C}}\geq 1\\ \frac{L}{t_{w}},&\frac{\lambda_{c}}{\mu_{C}}<1\end{array} \right. \tag{20}\]  
In (20), \(L\) indicates the time the attack spent on the network, \(t_{w}\) indicates the amount of time a legitimate client is prepared to wait to be served, and \(\lambda_{c}\) and \(\mu_{c}\) are the arrival and service rates due to the CPU exhaustion. The total depletion probability is obtained by evaluating the likelihood attributable to buffer exhaustion. The result of the simulation shows that the attack probabilities increase as the arrival rates increase. In most of the queue strategies for attack detection, such as drop-tail, random early detection (RED), and nonlinear random early detection (NLRED) [78], a pre-defined value is set for the maximum length of the queue. Newly arriving packets are discarded when the length of the queued packets exceeds the set threshold. In this queue approach, all the traffic packets are considered equal, regardless of the traffic type. The attacker will then send fewer TCP packets before waiting for the target server to respond because of packet loss. Consequently, the TCP session's throughput will decline [79]. In most queue modelling studies [77; 78; 79; 80; 81; 82], Poison distribution is used to describe packet arrival according to a random process. According to [PERSON] et al. [74], for traffic analysis, the queue must support exponential data, and requests must be processed using a first-come-first-served queuing analogy with a single server and obviously finite buffer state. Using this concept, a collection of data patterns was generated, and UDP floods were detected.