## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.6 Machine Learning-Based Detection Methods
The primary drawback of this study is that all traffic was generated artificially and that some traffic characteristics, including IP, protocols, and packet size, were randomly selected. The choice of these features was not discussed. Additionally, these features were insufficient to provide successful detection performance. [PERSON] et al. [143] proposed a three-layer adaptive machine learning framework for attack detection and mitigation in IoT networks. An adaptive multi-layered feed-forwarding scheme was developed using machine learning classifiers to examine the static features of SDN-enabled IoT network traffic to detect attacks. Within the first layer, classifiers were used to develop a DDoS detection model from the datasets. The findings from this layer were then compiled using an ensemble voting (EV) approach that was applied to the classifiers. The last layer was where live network traffic was measured and compared with the accumulated output of the classifiers to detect anomalies. Results indicate that the framework achieved accuracy ranging from 95% to 98.8%. The accuracy is found to be proportional to the number of test flows. The highest test flows produce the best accuracy. As observed in most of the previous studies [131; 132; 133; 134], the choice of feature selection has a considerable effect on the detection accuracy. To improve this, a plethora of multi-class machine learning approaches have been proposed. However, feature selection is still a difficult task. The study presented in [144] applied a hybrid methodology of feature selection to RF, DT, k-NN, and Extreme Gradient Boosting (XGBoost) classifiers. The hybrid feature selection methods are Chi-square, Extra Tree, and ANOVA. The effectiveness of this approach was validated using the CICDDoS2019 dataset. Evaluation results show that XGBoost with ANOVA has superior performance, with an accuracy of 98.35%. This performance was achieved with just 15 features and an 82.5% feature reduction ratio. When all the features were considered, the accuracy of XGBoost dropped to 96.7%. _Attack detection in UAV/IoD/FANET using machine learning:_ In [13], a machine learning-based approach was suggested for the detection and categorization of GPS spoofing attacks on UAVs. This study implemented three testing scenarios in an outdoor setting, where a sequence of GPS signal characteristics was gathered, and the UAV was subjected to spoofing attacks using an SDR transceiver module. Thereafter, a variety of machine learning classifiers were developed utilizing the datasets obtained from the testing setups of authentic and spoofed flight scenarios. The results presented revealed that the approach permitted detection of GPS spoofing attacks in UAV networks with a detection rate (DR), misdetection rate (MDR), and false alarm rate (FAR) better than 92%, 13%, and 4%, respectively. In [145], a hybrid of LR and RF was utilized to address security concerns with IoT-enabled drones. In this method, cybersecurity vulnerabilities were reduced by incorporating tactics inspired by artificial intelligence within the framework of a drone network. The performance of the developed approach was verified using KDD drone data and GPS characteristic data. Evaluation results indicated that an accuracy of 98.58% was achieved. Additionally, the approach was also evaluated using precision, recall, and F-measure metrics of 97.68%, 98.59%, and 99.01%, respectively. In [146], the authors modelled SYN traffic using Bayesian inference and created an algorithm to identify SYN flood attacks in several wireless ad hoc networks, including MANET, VANET, and FANET. Other than SYN flooding attack detection, the proposed algorithm also detects Hello flooding attacks, RREQ flooding attacks, data flooding attacks, and UDP flooding attacks without a dedicated server node. The DARPA 1999 dataset was used to demonstrate the effectiveness of the proposed scheme. The findings show that the algorithm records a higher true positive rate and precision level. [PERSON] et al.