## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.1 Entropy-Based Detection Method
Additionally, the efficacy of this strategy is called into doubt when numerous slow-rate DDoS attacks with various source IP addresses surface. An updated study by the same author is presented in [68]. In this study, DDoS attacks were detected using dynamic thresholding on flow-based features. Different traffic features were extracted in relation to packet amount, source IP, destination IP, and protocol, and then four attributes were calculated based on DDoS characteristics. Experimental observation showed that, during a DDoS attack, the estimated attribute values are extremely high. The entropy of the four attributes is compared to a threshold value, and a DDoS attack is considered to have occurred when it surpasses the threshold. The threshold is estimated in a similar manner to the research study in [67]. The threshold values are updated on a regular basis and change depending on the state of the network. Though the false positive rate was not examined, the method has a relatively high detection rate. Most entropy-based attack detection studies that have been conducted so far [61, 62, 63, 64, 65, 66, 67] rely on a few entropy-based features, which may limit the type of attack that may be detected as well as the accuracy. To overcome this issue, some other studies [69, 70, 71] have thought about using multi-entropy features. [PERSON] et al. [69] estimated the entropy across five flow parameters, including source and destination IPs, ports, and packets-per-flow. The outcomes demonstrate that the suggested approach can identify large alterations in network entropy time series. Although multiple features were considered, the mix of features employed is still straightforward and not comprehensive enough for practical application. [PERSON] _et al._[70] also utilized entropy vectors of different features from traffic flow for attack detection. The use of more thorough features to build clustering models makes this approach different from the studies in [69]. Additionally, based on the traffic models, a detection threshold was automatically created. Experimental results proved that the suggested approach is adaptable to real-world environments and has higher detection accuracy. Although the detection speed is poor, the accuracy of the detection improves when the data scale exceeds 4000. Furthermore, it is impossible to pinpoint the rationale behind the choice of feature thresholds. [PERSON] et al. [71] introduced a set of new entropy-based features, including source and destination IPs, ports, and protocols. Following that, a multi-classifier system (see Figure 10) was built using a set of various entropy-based features. The entropy of each traffic feature was computed for a 60 s interval. Regular and entropy variation features, as seen in Figure 10, were two different forms of entropy-based features that were computed. While the latter was obtained using the fluctuation of two different regular entropy features following a Lyapunov exponent separation, the former was computed using the entropy of raw traffic features. The performance of the approach was assessed using ISCX2012 and DARPA'98 datasets with a sensitivity of 94.7%. Although the sensitivity results are thought to be superior, the dataset utilized comprises obsolete DDoS attack vectors, making it uncertain whether the method can be applied to identifying modern attacks. An assessment of the  
Figure 10: Framework for multi-classifier entropy-based features for DDoS attack detection, adapted from [71]. traffic-based features used in an entropy-based approach is presented in [72]. The results presented revealed that a better approach must be adopted for choosing traffic features. The ability to detect anomalies is distinct and frequently enhanced by behavioural distributions that are qualitatively different from port and address distributions. A method for identifying traffic-based attacks using UAV and Wavelet Packet Energy Entropy (UWPEE) is suggested in [PERSON] et al. [11].