## 3 DDoS Attack Detection Methods  
Based on the increased frequency of attacks and their effect on the targeted network resources, it is vital to mitigate the attacks through an effective attack detection methodology. Numerous research studies dealing with this problem have been published, and different attack detection methodologies have been proposed, with varying degrees of success. In this section, DDoS attack detection methodologies are classified into three \begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline
**Attack Type** & **Classification** & **Features** & **IP Spoofing** & **Attacked Layer** & **Effect** \\ \hline HTTP fragmentation & Application-based & Splits an HTTP packet into smaller pieces and broadcast them at the slowest rates possible. & Non-spoofed & Application & Consumes all sockets \\ \hline IP packet option field/IP null & Protocol-based & Sets 1 to all quality-of-service bits. & Spoofed & Network layer & The victim’s processing capacity is overloaded \\ \hline Ping of death & Protocol-based & Forms a data packet that exceeds maximum packet size. & Spoofed & Network layer & Overloads the buffer and causes system crash \\ \hline UDP flood & Volumetric-based & Sends a significant volume of UDP packets to a target’s specified or random port. & Spoofed & Transport layer & Consumes network bandwidth \\ \hline ICMP flood & Volumetric-based & Utilizes the ECHO request packet of ICMP. & Spoofed & IP layer & Saturates victim’s network bandwidth \\ \hline Fraggle & Volumetric-based & Sends UDP\_ECHO packets to the network amplifier. & Spoofed & IP layer & Saturates victim’s network bandwidth \\ \hline NTP amplification & Volumetric-based & Exploits NTP using MON\_GETLIST command. & Spoofed & Application layer & Saturates victim’s network bandwidth \\ \hline DNS flooding & Application-based & Utilizes an amplified DNS response query. & Spoofed & Application layer & Saturates victim’s network bandwidth \\ \hline \end{tabular}
\end{table} 
Table 4: _Cont._  
Figure 7: Distribution of DDoS attacks: (**a**) frequency of attack categories between January 2020 and March 2021, (**b**) multi-vector attack scenarios. categories based on their technical nature of operation. As shown in Figure 8, DDoS attack detection methodologies are classified as traditional methods, signature-based detection, and anomaly-based detection. _Traditional methods_: These concentrate on measuring the traffic volume. When the measured traffic volume exceeds a predetermined level, a DDoS attack is identified. _Signature-based detection_: This method uses attack signatures that are kept in a database to find attacks. It involves tracking traffic patterns and comparing them to pre-existing signatures. Any differences from the previously recorded patterns indicate malicious traffic. It implies that only attacks whose signatures have been previously stored in the database can be detected. The method has high accuracy in detecting known attacks, provided the database is updated. However, any divergence from the attack signatures or novel attack pattern cannot be detected. _Anomaly-based detection_: This method involves gathering typical traffic behaviour over a predetermined period and creating a baseline profile. Any incoming pattern that is outside the scope of the baseline is viewed as an anomaly, which suggests that attacks have taken place. This method works incredibly well at identifying unknown and zero-day attackers. In Table 5, a comparison of the three major classifications of attack detection methods is presented. Although the traditional approach is quick, its applicability to the present-day security threats is constrained by detection accuracy and false alarm rates. The signature-based detection method cannot detect an unknown attack or even a variation in a known attack. Any variations in the already-existing attack signature patterns go undetected by these methods. In this instance, a lot of false alarms are triggered.