# Detecting DDoS Attacks in IoT-Based Networks Using Matrix Profile
## 2 Literature Review
### Machine Learning-Based Methods  
One study [14] illustrates a mitigation system to help protect the IoT against DDoS attacks. The paper proposes a model that can check network traffic and detect any DDoS attacks using an algorithm based on deep learning techniques. Another study [14] adopts convolutional neural networks to extract features of flows. After that, the researchers applied an auto-encoder to perform unsupervised malicious traffic classification. Their main object is a model that detects malicious traffic by checking a sample of packets as opposed to all traffic. They validate their system by comparing it with previous models. The authors claim that their system achieved 100% accuracy, which is somewhat unrealistic.  
Study [15] suggested a strategy to mitigate DDoS attacks in IoT networks. The researchers use learning automata concepts in their model: a Service-Oriented Architecture (SOA) is used as a model for the IoT. SOA is a platform for developing applications for the IoT. The findings reveal that the proposed scheme is effective in mitigating DDoS attacks in the IoT. Nevertheless, the authors make a controversial claim that their model prevents DDoS attacks, which is inaccurate as no security system can prevent these attacks. Existing systems can help mitigate DDoS attacks but not prevent them.  
The researchers in one study [16] proposed a DDoS attack detection method based on the support vector machine (SVM) in software-defined networks (SDN). The findings show that the average accuracy of the proposed technique is around 95.24% with a small amount of flow. Nevertheless, the disadvantages of the SVM model are that it requires excessive training and deep knowledge of machine learning, it is not easy to understand and interpret the final model, and it is not easy to fine-tune the SVM parameters.  
A comparison among different machine learning methods in detecting DDoS attacks is presented in another study [17]. The techniques studied are Artificial Neural Network (ANN), SVM, Naive Bayes (NB), Decision Tree (DT), and Unsupervised learning methods (X-means, K-means, etc.). Their findings show that all these methods can be used to detect DDoS attacks. The accuracy of these methods varies from around 91% to around 98%. Another study [18] also discusses using various machine learning techniques such as SVM, NB, and random forest algorithms. According to the authors, the suggested hybrid system shows better results and can be used for intrusion-detection purposes. SVM, NB, and random forest showed accuracies of 99.7%, 97.6%, and 98.0%, respectively.  
There are a few limitations in using machine learning to detect DDoS attacks. First, machine learning-based methods such as ANN depend on the hardware, which means they require high-performance computational power [19]. Therefore, this method may not be suitable for use at the router level as the router does not have high-performance computing capabilities. Using ANN could result in some network behaviour being unexplained, which makes it less reliable [20]. Additionally, ANN does not have a determined structure; the network structure is achieved through trial and error during the experiment [21]. SVM-based methods have many limitations as well. They require long training times and large datasets [22]. Additionally, it is not easy to choose the kernel function for the SVM, and it is difficult to understand and interpret the final SVM model [23]. Methods that use \(k\)-nearest neighbour (KNN) as a detection algorithm also have some limitations, including but not limited to the following: (i) accuracy depends primarily on the quality of the training dataset; (ii) \(k\)-NN does not perform very well (slow) with large datasets; and (iii) the space complexity is very high (requires large memory for large datasets) [24; 25].