## 2 Related Works  
This section summarizes and evaluates existing research papers on detecting attacks using the different IDS techniques listed above. Various machine learning algorithms have been used to identify DDoS attacks, mostly as classifiers. To mention a few, there are k-Nearest Neighbors (KNN), the Naive Bayes Classifier, support vector machines (SVM), random forest (RF), and neural networks (ANNs) [1; 14] presented an interactive intelligent detection method for detecting DoS/DDoS attacks. The detection algorithm made use of the random forest tree technique to identify different DoS/DDoS attacks, including flood TCP, flood UDP, flood HTTP, and sluggish HTTP. However, Ref. [15] employed bio-inspired machine learning metrics to quickly and accurately identify HTTP flood attacks. The developers of [15] used the Bat algorithm, which is a low-complexity algorithm, as a bio-inspired method. While [16] presented a TCP flood DDoS detection methodology. Different ML classifiers, such as SVM, Naive Bayes, and KNN, were all used in this model. However, Ref. [17] demonstrated detection based on the covariance matrix method. The suggested detection was separated into training and testing steps. A training phase was designed to build a typical network traffic profile. The testing step was designed to detect any anomalous traffic by measuring the difference between usual and any other network activity. The regular traffic was recorded in their cloud from end-users surfing the Internet, whilst the flooding attack traffic was created using the PageRank application. It was analyzed using the confusion matrix and the findings were presented for a public and private cloud system. The authors of [18] utilized the NB technique to accurately anticipate the occurrence of DDoS attacks based \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt}} \hline \hline
**Research Question** & **Motivation** \\ \hline _RQ1:_ How can the CNN + BiLSTM hybrid DL model predict DDoS attacks based on benchmark data set? & Investigate the suggested hybrid deep neural network model (CNN+ BiLSTM) and apply it to predict DDoS attacks using benchmark data. \\ \hline _RQ2._ How can we compare the suggested CNN + BiLSTM model to traditional ML techniques? & Examine traditional feature representation-based ML approaches such as the random forests (RF), k-nearest neighbors algorithm (k-NN), logistic regression (LR), and support vector machine (SVM) as well as various evaluation metrics like as accuracy, precision, recall, and F1-score. \\ \hline _RQ3_ How do we compare the suggested technique’s effectiveness in predicting DDoS attacks using benchmark data to baseline studies and other DL approaches? & In contrast to other DL models (CNN, long short-term memory (LSTM), recurrent neural network (RNN), and BiLSTM), and state-of-the-art benchmark studies that focus word embedding-based feature map, investigate the efficacy of the suggested DL model (CNN + BiLSTM) which forecasts DDoS attacks using various evaluation performance measures such as precision, accuracy, recall, and F1-measure. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Research questions. on the mean and significance variance of packet headers. An RF is a grouping of decision trees. The categorization is determined by the proportion of the outputs of particular decision trees. To cope with the variety of network attacks, [PERSON] employed the DBSCAN clustering approach [19]. In their trials, the suggested scheme performed well with key attributes. The authors of [20] examined the issue of intrusion detection and developed a two-stage ADOA approach to tackle it. To begin, the detected anomalies are grouped, and the unlabeled examples are sorted to obtain prospective anomalies and trustworthy normal occurrences by resolving the differences among anomalies. This is done by assigning labels to the aforementioned examples, and then creating a graded multi-class framework that may be used to differentiate distinct anomalies from the regular cases.