## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.6 Machine Learning-Based Detection Methods
The results of the simulations demonstrate that the proposed model is 100% accurate in localizing the attacks in each scenario. To generate datasets, the authors, however, employed a small network. Similarly, [PERSON] and [PERSON] [156] examined the efficacy of machine learning classifiers for the detection of SH, BH, Sybil, CID, SF, and Hello flooding (HF) attacks in RPL-based IoT networks using Boosted Trees, subspace discriminant, RUSBoosted Tree, and bagged trees. Hold-out and cross-validation methods were used to investigate this performance. According to simulation results, the subspace discriminant model performs the worst, with an accuracy of 77.8% and an area under the curve (AUC) of 0.87 for a 40% hold-out validation, while the ensemble of Boosted Trees performs the best, with an accuracy of 94.5% and an AUC of 0.98. The Boosted Trees and RUSBoosted Trees have the best accuracy and AUC, respectively, in the cross-validation scenario. In [PERSON] et al. [157], the potential of three machine learning classifiers was examined for attack detection in RPL networks. The Cooja network simulator was used in this study to create a multi-class dataset that included a standard traffic pattern and four RPL attacks, including HF, flooding, VN, and DR attacks. These datasets were evaluated independently using the classifiers RF, NB, and J48. Experimental results indicated that the RF classifier has the best performance. Superior to NB and J48, RF achieved precision, recall, and accuracy values of 99.4%, 99.3%, and 99.33%, with the J48 classifier performing the worst. _Attack detection in NDN using machine learning:_ Named Data Networking (NDN) is an emerging next-generation network architecture that is anticipated to replace the current IP-based internet infrastructure. It employs the content-centric networking paradigm, where content is retrieved using names rather than the network addresses of the servers hosting it [158]. In this architecture, a source can request content by employing name prefixes rather than the present IP prefixes to route an interest request. Interest packets are routed to the location of the original source of the content. Any router and intermediary node, along the path, search their cache for identical copies of the requested content. Any piece of interest request that has a cached copy is returned to the requester along the path it originated from. All middle nodes keep a copy of the content in their caches on the way back to prepare for potential same-interest requests from incoming requests [158]. Each NDN router maintains three fundamental data structures: the Forwarding Information Base (FIB), Pending Interest Table (PIT), and Content Store (CS) [159]. NDN was initially projected to address the basic shortcomings of the existing internet-based network, but attackers are now using the two unique features in NDN routers, CS and PIT, to launch new variants of DDoS attacks against it. Thus, they are susceptible to new types of attacks. The two most prominent categories of DoS/DDoS attacks in NDN infrastructure are the interest flooding attack (IFA) and content/cache poisoning attack. Other forms of attack in NDN, such as cache privacy attacks, cache pollution attacks, and false locality attacks (FLA), have been reported [159; 160]. The goal of content poisoning is to prevent users from accessing legitimate content by forcing routers to forward and send spoof data packets [158]. The IFA is one of the most severe attacks in NDN. This attack is an extended feature of DDoS in NDN, whereby the attackers flood the network with many non-existing interest packet requests. These requests are stored in the PIT of the NDN routers in between. Due to the persistence of these entries in PITs of NDN routers, valid requests are denied space in the PITs [158; 159]. Despite the NDN's potential, it still lacks a good defence scheme against DoS and DDoS attacks. Deep learning and machine learning techniques have recently been developed for NDN attack detection. [PERSON] et al.