# Detecting DDoS Attacks in IoT-Based Networks Using Matrix Profile
## 2 Literature Review
### Other Methods  
The authors of one study [5] propose a DDoS detection method for smart cities. The proposed technique takes a defensive or self-protective stance by using load balancing to mitigate the impact of DDoS attacks in smart cities. The proposed methodology is based on keeping track of trusted IP addresses and diverting new IP addresses in cases where a DDoS attack is detected. In addition, this method checks the identity of IP addresses and then decides whether the traffic is an attack or legitimate. For instance, if the IP address of a CCTV is trying to connect to the Facebook or Twitter server, it might be a DDoS attack as these companies do not yet provide services to IoT devices such as CCTV. Although the authors claim that their method is effective, there is not enough evidence or experimentation discussed in the paper to support their claim; neither have they discussed the scalability of their proposed method.  
One study [12] proposes a constrained application protocol at the application layer to detect and mitigate DDoS attacks in IoT-based smart homes. The researchers use datagram transport layer security (DTLS) as a security protocol for securing communication between clients and servers. The authors propose a novel algorithm for the detection and mitigation of DoS and DDoS attacks at an early stage, and they use the Contiki Cooja simulator. They claim that their findings show that their proposed model performs better than the E-Lite system. Their comparison criteria are the malicious packet delivery ratio and legitimate packet delivery ratio. However, this is a short paper, and no details are provided.  
A correlation-based method is proposed in another study [31] to detect DDoS attacks. The authors use a hybrid method composed of a machine learning-based method (\(k\)-nearest neighbours) and a statistically based method (correlation analysis) to detect DDoS attack traffic. The authors claim that their hybrid method improves the detection rate compared to the statistically based method alone. Nevertheless, this method is very complicated and shares the limitations of \(k\)-NN and statistical methods.  
The authors of another study [32] present a lightweight defensive algorithm for DDoS attacks in the IoT network environment. The paper contains preliminary findings. The authors use Contiki OS, COOJA, and Rime stack to model their system. The proposed model is utilised to detect DDoS attacks. The authors claim that the proposed model is effective against DDoS attacks. However, the mechanism used to detect DDoS attacks is not explained in the paper. The authors claim that their model is effective, but a justification is missing.  
DDoS attacks on cloud auto-scaling mechanisms are investigated in another study [33]. An auto-scaling system is proposed to protect the cloud from DDoS attacks. Yo-Yo is a relatively new DDoS attack, which is investigated in this study. The authors demonstrate a DDoS attack on a computing instance (EC2) and analyse the victim's protective measures by re-configuring the auto-scaling mechanism.  
Attackers can use many types of DDoS attacks to attack any victim's server, each of which has its own pattern and features, making it very difficult to cope with such threats. After reviewing many research papers that use different techniques, such as machine learning, statistically based algorithms, and SDN techniques, to the best of our knowledge, we could not find any research investigating the possibility of utilizing time-series methods and the algorithms used to analyse network traffic in order to detect DDoS attacks in network traffic in IoT.  
The Intrusion-Detection System (IDS) normally depends on a statistical algorithm to detect a DDoS attack [34]. We focus on identifying DDoS traffic using an anomaly detection mechanism. Furthermore, an IDS works on the victim side only, while our proposed system detects DDoS attacks on both the compromised IoT nodes being used to perform a DDoS attack and the victim side (servers).