## 5 Proposed Taxonomy of the Attacks, DDoS Attacks, and DDoS Detection Approaches on CC
### Taxonomy of DDoS Attack Detection Approaches on CC
#### 5.3.5 Filtering Tree-Based Detection  
A technique proposed in [147] identifies flood attacks by analyzing network logs and keeping track of the connection states, such as the active IPs of incoming requests. It alters the window size (number of time slots) and measures the sliding window of dynamic entropy, which is dependent on traffic load. In a CC setting, traditional DDoS attacks on servers and network resources could morph into a new breed of attack called EDoS attacks, which target the CCC's economic resources. The researchers have presented a unique mitigation strategy against EDoS threats, utilizing source checking, counting, and Turing Test. The simulation results suggest that their technology can mitigate CC EDoS attacks. \begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Refs** & **Approach used** & **Advantages** & **Disadvantages** & **Note** \\ \hline
[140] & Information-Theoretic Entropy and Random Forest & high HTTP DDoS attacks detection performances & Not yet deployed in the real world & They planned to perform real-world deployment of this approach and evaluation w.r.t. several HTTP DDoS attacks tools as a future scope & They planned to perform real-world deployment of this approach and evaluation w.r.t. several HTTP DDoS attacks tools as a future scope & They planned to perform real-world deployment of this approach and evaluation w.r.t. several HTTP DDoS attacks tools as a future scope & They proposed architecture and recommendation may be applied on a CC platform to accurately identify DDoS attacks. The concept can be expanded to include a recovery mechanism for DDoS attacks & The proposed scheme with two checkpoints will be a superior alternative solution in reducing risk and providing a better outcome this approach can be extended for developing an efficient detection for attacks. This algorithm works in 2 phases. First, users are permitted to travel through the router on the network site. While in the second, the traffic passes through a cloud-based router that uses a confirmation algorithm and checks for a threshold value & This algorithm works in 2 phases. First, users are permitted to travel through the router on the network site. While in the second, the traffic passes through a cloud-based router that uses a confirmation algorithm and checks for a threshold value & This algorithm works in 2 phases. First, users are permitted to travel through the router on the network site. While in the second, the traffic passes through a cloud-based router that uses a confirmation algorithm and checks for a threshold value \\ \hline \hline \end{tabular}
\end{table} 
Table 14: Entropy-based DDoS detection approaches. \begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Refs** & **OSI** & **Feature Selection Tool** & **Features Used** & **Dataset Used** & **Parallel Processing** & **Algorithm Used** \\ \hline
[140] & **I** & Unknown & Source/destination ports, source/destination IP & CIDDS-01 & ✗ & ITE ML, RFEL \\
[141] & **L3, 7** & Unknown & Traffic distribution like IP address, Port, number of packets & Unknown & ✗ & Attack Packet dropping \\
[145] & **L3, 7** & Unknown & The huge distance between the data and baseline entropy & Unknown & ✗ & NA \\
[83] & **I** & Unknown & Entropy, HTTP-CIF request count, and difference for every connection, IP address & EPA-HTTP & ✗ & MLP, GA, Artificial Neural Networks (ANN) \\
[146] & **L3, 4, 6, 7** & Unknown & IF address, port, flow size & Unknown & ✗ & Detection algorithm, Confirmation algorithm \\ \hline \hline \end{tabular}
\end{table} 
Table 15: Advantages and disadvantages of entropy detecting. Researchers in [148] proposed a CC defender system named cloud service queuing defender (CSQD) to detect and remediate XML vulnerabilities in online services. CSQD, a self-learner, employs a traceback solution to determine the source of the attack.