## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.3 Statistical-Based Detection Methods
The authors of [103] suggested a simple method for detecting SYN flooding attacks using the non-parametric CUMSUM model. The results of the simulation showed that TCP-SYN flooding may be accurately detected with a low false alarm ratio and a high detection ratio. In the research study presented in [102], the authors investigated the use of CUMSUM for detecting DDoS attacks in an IoT network. The algorithm has a good detection rate for high-rate attacks but is poor for low-intensity attacks. A combination of CUMSUM and an entropy-based method is reported in [104]. The CUMSUM is used in this work to handle traffic entropy. For the observed entropy data, additional signal processing, utilizing wavelet pre-filtering, is used. This helps to improve detection efficiency over other CUMSUM approaches that rely solely on the entropy of the packet header field without further processing. The findings revealed high detection accuracy and a low proportion of false positives. The authors in [105] investigated the potential of SSMs to minimize false detection during DDoS attacks. With this method, the traffic flow is sampled at regular intervals to identify the distinctions between legitimate and malicious traffic. After that, correlation analysis is used to separate attacks from legitimate flows by comparing the samples to pre-specified attack state conditions. Evaluation results reveal a mix of segregation methods that could significantly lower the likelihood of false detections during DDoS attacks. The results also demonstrate higher detection latency and increased computational overhead. [PERSON] et al. [106] used MCA for attack detection. In this study, the patterns of legitimate network traffic are examined, and the traffic is then classified by obtaining the geometrical correlations between network traffic parameters. To expedite the MCA procedure, a triangle-area-based approach was also added. The effectiveness of this method was assessed with the KDD Cup'99 dataset. The approach has excellent performance with 99.95% detection accuracy. However, some poor performance was observed when the false positive rate was analysed. The proposed approach could be further validated on some other dataset with the updated DDOS attack vectors. More advanced categorization algorithms and the use of real-world data would also reduce the false positive rate. In [107], the analysis of covariance was proposed. The method's efficacy in detecting SYN flood attacks has been established. The approach has relatively high detection accuracy. The approach does, however, have certain drawbacks. There is no theoretical justification for the high detection rate. The method also faces the difficult task of choosing an adequate observed time window for the covariance analysis. An improvement on the covariance approach is presented in [108]. In this study, a covariance criterion was used to generate a profile of typical network traffic and identify anomalous activities. Then, a decision-making rule that considered all the data in the covariance matrix was integrated using the Chebyshev difference. The results show that the detection rate improved. However, because there is so much data to handle in the covariance matrix, the approach has a huge computational complexity problem. [PERSON] et al. [109] use a sequential-non-parametric change point for detecting bandwidth attacks. The approach involves tracking a rising number of new IP addresses, followed by a statistical analysis of the incoming traffic over a period to determine the typical time interval. The arrival rate of new IPs is then compared to the normal value, and, when this exceeds the average arrival time, a bandwidth attack alarm is generated. Although the technique records a relatively good detection rate, a significant drawback was noticed. Since the detection method can only identify an attack when there is a dramatic change in the volume of existing network traffic, a spoof IP address will bypass the detection approach.