## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.6 Machine Learning-Based Detection Methods
[147] proposed a multi-agent and DT-based machine learning approach for the detection of DoS attacks in IoD networks. The approach permits the detection of both unknown and known DoS attacks in UAV networks, with low false positive and negative rates and good performance when demonstrated on the CICIDS2017 dataset. _Attack detection in RPL-based IoT using machine learning:_ IoT devices have limited resources, so they cannot use conventional Internet routing protocols. As a solution to this problem, the RPL defined by the IETF is seen as a viable method to satisfy the routing requirements of Internet of Things networks and reduce resource consumption along the routing path. This protocol can adapt to various situations and has several secure modes. The RPL is a distance-vector routing protocol that builds its topology on a Destination-Oriented Directed Acyclic Graph (DODAG) [148]. In this architecture, traffic is routed to one or more root nodes using a point-to-point (P2P), multi-point-to-point (MP2P), or point-to-multipoint (P2 MP) network topology, since all nodes are connected in such a way that there are no round-trip pathways. It has been shown that malicious nodes can carry out their operations while the packets are being routed and forwarded; thus, the security of RPL routing data in the IoT has been a significant challenge. This enables several attack types to take place within the routed data [149]. One of the primary attacks on RPL is flooding attack. In this attack, an excessive amount of traffic is created in a network using the Hello message to disable nodes and links. This attack consumesthe resources of the nodes, such as storage, energy, and processing, to cause a denial of service. Other notable forms of attacks in RPL-based IoT networks, such as Sybil attack, wormhole (WH), selective forward (SF) attack, sinkhole (SH) attack, clone ID (CID), version number (VN), and blackhole (BH) attack, have been reported [150, 151, 152]. The Sybil attack is extremely similar to a clone ID attack, which allows for the control of a sizable portion of a network without the use of actual physical nodes. Due to variations in topology and complexity, as well as dissimilarity in traffic patterns, conventional security measures, such as those centred around encryption and threshold, are ineffective in detecting attacks in RPL-based IoT networks. Machine learning and deep learning models has been used because of this. [PERSON] et al. [153] investigated the use of machine learning for Sybil attack detection in RPL-based IoT networks. In this study, NB, RF, and LR classifiers were applied to the data that were generated using the Contiki-Cooja simulator. The performance of the algorithms was evaluated using the accuracy and packet delivery ratio. Experimental results show that NB has the best performance, with 92.14% accuracy, and the best packet delivery ratio, while LR has the worst performance in terms of both metrics. In [PERSON] et al. [154], an attack detection framework was proposed for VN attack detection in RPL-based IoT networks using light gradient boosting machine (LGBM). The dataset for this work was largely created through simulations using Cooja tools for VN attacks. This was followed by a feature extraction module, an LGBM-based classification algorithm, and model parameter optimization. Simulation results proved that the proposed method is effective in identifying VN attacks, with a 99.6% accuracy rate. Additionally, 99.6% precision and a 99.6% F1-score were recorded. The proposed approach occasionally generates false alarms. Additionally, only one attack can be localized. Moreover, the method requires lengthy processing times and high computational overhead. In [155], ANN was employed in RPL-based IoT networks to identify HF, DR, and VN attacks. Ten-fold cross-validation techniques were utilized in this study to prevent over-fitting. The performance of the proposed model was compared, considering both the holdout approach and the ten-fold cross-validation technique.