## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.4 Attack Detection Methods Based on Chaos Theory  
Chaos theory is the mathematical study of nonlinear phenomena that are challenging or practically impossible to anticipate. As mentioned earlier, every forecasting technique will inevitably produce some errors. Hence, the resultant error needs to be carefully examined. It is possible to know if the error generated exhibits chaotic behaviour or not by computing the Lyapunov exponent, using (24) [115]:  
\[\lambda_{i}=\lim_{x\rightarrow\infty}\frac{1}{t_{i}}\ln\bigg{|}\frac{\Delta X _{i}}{\Delta X_{0}}\bigg{|} \tag{24}\]  
A positive Lyapunov exponent reveals the existence of chaotic behaviour in the prediction error values, which is an indication that the forecast prediction is significantly different from the typical observed values. Because there is little variation between the predicted and actual observations, a negative value indicates that the error is not chaotic. In chaos-based DDoS attack detection, Lyapunov exponents are used to know whether an event is normal behaviour or an attack [116; 117; 118; 119; 120; 121]. [PERSON] et al. [116] provided one of the early efforts in this field. To ascertain whether there was attack traffic, the authors looked at the average exponential rate of dispersion across two nearby orbits (normal and new traffic). This work used (24) to compute and analyse the Lyapunov exponent. DDoS attack detection is made possible by (25):  
\[\lambda_{i}=\left\{ \begin{array}{ll}>1&\Rightarrow DDoS\ \ attack\\ \leq 1&\Rightarrow Normal\ traffic\end{array} \right. \tag{25}\]  
If \(\lambda_{i}>1\), it demonstrates how chaotic and unstable the network traffic orbit is. As a result, the closest points disperse at any arbitrary range. This indicates that an attack is the cause of the change in traffic. This network activity is categorized as DDoS attack activity. In the absence of an attack, the orbits are drawn to a fixed point from where they dispersed; therefore, the traffic change is caused by new legitimate traffic rather than an attack. The study recorded a detection rate ranging from 88% to 94%, with a lower false positive rate, from 0.455 to 0.05%, when demonstrated on the DARPA dataset. Similarly, in [117], chaos theory and Lyapunov exponents were employed to detect attacks in cloud computing environments. Inspired by [116], the study records an average detection rate of 89% with 11% false positive rates. The authors of [118] presented DDoS intrusion detection via network traffic prediction and chaos theory. To train a neural network to detect anomalies caused by either bursty legitimate traffic or DDoS flooding attacks, results from a local Lyapunov exponent are used. Computer simulations conducted on the DARPA network traffic dataset show that a detection accuracy of 93.75% was recorded. The accuracy is marginally higher than that noted in [116; 117]. There was no report on the evaluation of the false alarm rates. The research provided in [119] is comparable to that in [118]. However, in this study, a change in the Lyapunov exponent is suggested for detecting anomalies in the network traffic. Chaotic analysis is performed on the entropy of source and destination IPs to achieve attack detection. This method performed better than the previous studies, with a record true positive rate of 98.56% when demonstrated on the DARPA'99 dataset. In [120], the chaos-based hypothesis for DDoS attack detection is validated. The study involves the prediction of network traffic using SES. Thereafter, prediction errors were evaluated with chaos theory and a back propagation neural network. The results indicated that a detection accuracy of up to 98.04% can be achieved using the chaos hypothesis. The authors in [89] presented a similar procedure for detecting DNS amplification. A Lyapunov exponent is determined over a window size. Following that, network traffic is categorized as either normal or abnormal, using the exponent analysis described in [116]. This study records a lower detection accuracy of 66%.