# Detecting DDoS Attacks in IoT-Based Networks Using Matrix Profile
## 3 Methodology: Matrix Profile
### Matrix Profile Procedure  
The matrix profile is calculated using a receding horizon or sliding window algorithm in which a subset of a time series is compared with the rest of the time-series data. The following steps summarise how the matrix profile is calculated. 1. Calculate the distances for the windowed sub-sequence from the whole dataset. 2. Set an exclusion zone to ignore trivial matches. 3. Update the distance profile with the minimal values. 4. Set the first nearest neighbour index [36]. The essential purpose of using matrix profile is to find motifs and/or discords in time-series datasets, in other words, to highlight any interesting events, patterns, or anomalies. The author of one study [36] defines motifs and discords as follows: \"Motif is a repeated pattern in a time series and a discord is an anomaly\". Having calculated a matrix profile from a time-series dataset, it is straightforward to identify the top \(K\) number of anomalies (discords) and/or pattern motifs in the dataset. Matrix profile reserves the distance in Euclidean space, which means a distance near zero is most similar to other sub-sequences in the time-series data. On the other hand, a large figure (\(\geq\)50) indicates a sub-sequence unlike any other sub-sequence (anomalies). To sum up, motifs (patterns) can be found by extracting the lowest distances, whereas discords (anomalies) can be identified by finding the largest distances in the time-series dataset [35; 36]. According to the authors of one study [36], the algorithms used to calculate the matrix profile can be classified into two main types (algorithmic implementations): exact and anytime algorithms. Exact algorithms calculate the exact solution, which means that the algorithms must complete all calculations before providing any solution (matrix profile). The list below demonstrates the algorithms that can be used to compute the matrix profile:  
* MPX: a high-speed algorithm that does not require a Fourier transform to compute the matrix profile. * STOMP: the first algorithm that can be used to calculate the matrix profile for any time-series dataset. * Brute force PMP: this type of algorithm is considered slow because it tries all possible data and thus is not recommended for large datasets. In the following, we demonstrate how matrix profile works through an example. **Example 2**. : _To ensure that the above-mentioned explanation is clear and understood, we demonstrate it here with simple numerical values. Assume a time-series \(T\) with length \(n=13\). The real values of \(T\) are illustrated in Figures 2 and 3. It is assumed that the sliding window size is 4, \(m=4\). For simplicity, we do not use \(Z\)-normalised values in this example._Figure 4 illustrates how the sliding window works in the matrix profile. In this example, we use a window size of four to calculate the Euclidean distance using Equation (1). The first value is calculated by comparing two points in the time-series data, which are (0, 1, 3, 2) and (0, 1, 3, 2). The Euclidean distance \(d\) between these two points is \(d=\sqrt{(0-0)^{2}+(1-1)^{2}+(3-3)^{2}+(2-2)^{2}}=0\); thus, this is a trivial match. Next, the blue window begins shifting to the right by one cell. The same equation is then used to calculate Euclidean distance, \(d=\sqrt{(1-0)^{2}+(3-1)^{2}+(2-3)^{2}+(9-2)^{2}}=7.4\); see Figure 5. Next, the sliding window continues shifting one cell to the right, and the distance is calculated until the end (see Figure 6). Subsequently, the minimum value in the distance array is added to the matrix profile. Note that trivial matches should be disregarded as they merely compare data with itself, so they are not considered as minimum values in the distance array. In other words, The second minimum value should be chosen. Figure 4: Sliding window: First step in the first iteration to calculate the distance array and matrix profile. Figure 5: Sliding window: Second step in the first iteration to calculate the distance array and matrix profile.