## 5 Key Findings and Discussions
Even though computational power has increased, the algorithm cannot reliably detect attacks in an anonymous and encrypted network environment. Thus, an adaptive window size may improve the accuracy of the approach. This means that the trade-off between window size and computing power cost requires additional research. Entropy-based DDoS attack detection methods only require a minimal amount of network packet header information to construct patterns of legitimate traffic, as noticed in several studies [61, 62, 63, 64, 65, 66, 67]. Thus, they require fewer resources and enable quick and relatively more accurate detection. However, these methods strongly depend on the use of thresholds to achieve the desired detection results. It can be difficult to choose the right detection threshold in various attack environments due to the dynamic nature of network traffic patterns and rising attack intensities. Therefore, this approach requires a self-adaptive threshold, which is currently challenging to establish. Entropy values are also proven to be unable to distinguish between distinct traffic feature distributions with the same degree of uncertainty. As a result, anomalies that are unrelated to chance are missed. Similarly, the heuristic-based detection system [122, 123, 124, 125] also requires a detection threshold to achieve a result. Though the threshold decision is optimized, as noted in [122], the DDoS defence of HBDS is based on an adjustable threshold. This means each approach might need to determine its own threshold to assess the currently observed traffic. In addition, HBDS also consumes computational resources such as CPUs and memory. The findings also reveal that most of these approaches could not effectively analyse traffic features, which affected their detection accuracy. To improve on this, machine learning techniques are currently being used because they can learn the characteristics of traffic and create a very precise model for identifying anomalous traffic features. Despite the relatively higher detection accuracy that machine learning algorithms have achieved, traditional machine learning models, such as SVM [127], k-NN [134], DT [135], NB [149], RF [158], etc., are shallow learners with a high error rate due to false alarms and changes in network traffic. This might restrict how many of these models can be used in real-world scenarios. Additionally, the features chosen from the datasets have a big impact on the detection accuracy. Results presented in Figure 15 show that the level of accuracy recorded by these models varies. Although this strongly depends on the quality of the dataset used and the application environment, it is evident that, even when using the same network dataset, different feature selections can produce very diverse results. The size of network traffic is rapidly expanding due to the established effectiveness of IoT technology with big data. Thus, conventional machine learning models may struggle to work with massive amounts of data due to their limited ability to learn features. Additionally, as data volumes increase, the likelihood of false alarms rises dramatically. The structure of deep learning models has overcome the feature engineering problem found in the shallow machine learning models. This permits them to manage enormous datasets and learn more complex patterns within those datasets [163]. However, because there are so many layers being used, a long processing time is expected. DDoS attacks should be detected as quickly as possible, which has been a significant problem for deep learning models. Furthermore, they increase the processing overhead, making them difficult to use in IoT devices.