## 2 Taxonomy of DDoS Attacks  
### DDoS Attack Architecture  
In a DDoS attack, numerous devices attack a single server or network. This attack aims to overload a targeted server or network with numerous spoof requests to interfere with its regular traffic. This overwhelms the network resources, and, as a result, legitimate traffic encounters service disruptions. These attacks are executed with networks of internet-connected devices--including PCs and other devices (such as IoT devices) that have become infected with malicious software and are, thus, susceptible to remote manipulation. These devices are known as bots. DDoS attacks are effective because they use botnets, or groups of compromised computers, as their primary attack source. Once a botnet has been established, the attacker can direct the attack by sending remote commands to each bot. Each of the bots in the botnet sends queries to the IPs of the victim's server while it is being targeted by the botnet, which may overwhelm the network and disrupt legitimate traffic. Each bot is a real internet device which makes it challenging to differentiate between attacks and legitimate traffic. As was already established, DDoS attackers initiate their attacks via a botnet; therefore, the architecture of a DDoS attack will consist of an attacker, a botnet, and the target network or server. Different architectures emerge from how botnets are managed. As reported in [34], DDoS attack architecture can be categorized as centralized or decentralized. These architectures are illustrated in Figure 3. A centralized one is depicted in Figure 3a. It has an attacker, the target server, a botnet, and a command-and-control (C&C) system. In certain literature studies [35; 36; 37], the C&C systems are sometimes referred to as handlers. The bot computers in the botnet cannot communicate with one another \begin{table}
\begin{tabular}{l c c c c c c c c c c c} \hline \hline
**Topics Covered** & [23] & [24] & [25] & [26] & [27] & [28] & [29] & [30] & [31] & [32] & [33] & **Our Work** \\ \hline Security issues in IoT & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline Detailed taxonomy of DDoS attacks & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline Entropy-based detection & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline Chaos-based detection & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline Detection-based on Chi-square & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline Detection-based on queuing model & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline Statistical forecasts methods & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline Traffic pattern analysis & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline Correlation of IP address & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline Heuristic-based detection & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline Detection via machine learning & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ & ✓ & ✗ & ✓ \\ \hline Detection via deep learning & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline Attack and detection studies in IoD, & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \multicolumn{1}{l}{FANET, RPL-based IoT, and NDN} & & & & & & & & & & \\ \hline Comparison of the research studies & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ & ✓ & ✓ & ✓ & ✓ \\ under each detection methods & & & & & & & & & & \\ \hline Benchmarked datasets & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline Evaluation metrics & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ \\ \hline Open challenges & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ & ✓ & ✓ & ✓ & ✗ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of the current study with other related survey papers. under this architecture. Instead, every bot is linked to a C&C system. Therefore, the botnet is controlled by sending commands to these bots directly. In a decentralized architecture (Figure 3b), the bots establish a peer-to-peer (P2P) network. An attack query is sent to a certain bot to start the DDoS attack. The commands are then forwarded by this bot through P2P to other bots in the network.