## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.5 Heuristic-Based Detection System (HBDS)  
In this method, detection threshold decisions are made by using algorithmic logic to analyse the statistical features of network traffic. The network traffic is adaptively fine-tuned, and the detection thresholds are optimized using an optimization model to minimize false positives and false negatives. To obtain better results, the HBDS heavily relies on the use of a classification method in conjunction with optimization. Recently,studies have investigated attack detection and classification, employing both machine learning and optimization methods. Due to the high computational cost incurred by most HBDSs, [PERSON] and [PERSON] [122] suggested an adaptive hybrid neuro-fuzzy system for DDoS attack detection with substantially reduced cost. In this study, the adaptive neuro-fuzzy inference system (ANFIS) was employed as the basis classifier. The approach is suited to real-time network datasets, since it can handle both discrete and continuous features in a dataset. The proposed approach also records a detection accuracy of 99.2% using fewer statistical features from the traffic pattern in the dataset. However, it has been demonstrated [61, 62, 63, 64, 65, 66, 67] that using a multi-feature will improve the precision of any detection method against a variety of attack features. Therefore, the use of less advanced features may restrict its application to current and next-generation attacks. Furthermore, some false alarm cases were recorded. In [123], the authors integrated a multi-objective optimization method with a convolutional neural network (CNN) for DDoS attack detection in IoT networks. In this study, CNN's LSTM deep learning technology was combined with the Jumping Gene-adapted NSGA-II multi-objective optimization method to categorize network traffic as attack or legitimate. The applicability of this approach was demonstrated on the CISIDS2017 datasets, with 99.03% accuracy and a reduced training time. The records of the false positive rates were not analysed. The authors of [124] went on to demonstrate that multi-objective feature selection can increase attack detection accuracy while having a very low false alarm rate. One of the biggest problems with most attack detection studies is the feature selection of network packets, which may result in some false alarm rates. In [124], a multi-objective optimization problem was developed to improve on the earlier challenges. The optimization problem was solved using a non-dominated sorting genetic algorithm with an adapted jumping gene. Thereafter, a machine learning model was employed as a classifier to select features. The method records a detection accuracy of 99.9% with just 6 features and a runtime of 0.02 s, which indicates that the detection speed is better. Despite the better detection speed, the authors in [125] used 10 more features to attain the same accuracy. Additionally, there was no discussion of the feature selection in this study. The results of the false positive and false negative rates were also not discussed in either study. In [126], the authors attempted to solve DDoS attack detection feature selection problems with an intelligent wrapper feature selection model that incorporates binary-particle swarm optimization. Out of the 76 features in the CICIDS-2017 dataset, 19 were the best chosen. Various classification techniques were used to train and assess these features. Among the classifiers investigated, the decision tree classifier gave the best performance, with the highest accuracy of 99.52%. The research study in [127] was also based on analysing traffic features and optimally selecting the best features for DDoS attack detection in cloud-based networks. This method gathers service requests from users, groups them as log information, and then uses the Bhattacharya distance metric to classify the most significant features. Following that, a Taylor-Elephant Herd Optimization was developed to select the features optimally. The selected features were used to train a deep belief network.