## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.3 Statistical-Based Detection Methods
_Statistical forecasting models:_ A conventional statistical forecasting model makes predictions about future occurrences using statistics derived from historical data. Using historical data to analyse and observe past network traffic patterns, this method forecasts future observations. A plethora of statistical forecasting models have been developed for attack detection. Moving average (MA), weighted moving average (WMA), simple exponential smoothing (SES) or exponential WMA, double exponential smoothing (DES), and triple exponential smoothing (TES) are a few examples of this. Each of these models has its own accuracies and deficiencies. MA is a smoothing technique that observes the underlying pattern of a data set to forecast future values. While SES, EWMA, and DES consider both historical observations and historical forecasts, MA and WMA base their forecasts solely on prior observations. The authors in [90] revealed that the EWMA models could be used for detecting rapid changes in event intensity when demonstrated on the publicly available DARPA dataset. In [90], an adaptive threshold algorithm based on the EWMA model was developed for detecting SYN flooding attacks. Real traffic traces were employed to analyse the effectiveness of the algorithm. A satisfactory result was observed when high-intensity attacks were considered. However, the algorithm performs terribly when handling attacks of low intensity. Similar to the studies presented in [90], [PERSON] et al. [91] assessed the use of the EWMA algorithm for DDoS attack detection in IoT infrastructure. A high detection rate was achieved with a 40 s delay when demonstrated on an artificially generated dataset for a high-rate attack. While the detection rate of this approach is relatively high for attacks with high intensity, its performance deteriorates for attacks with low intensity. The use of an adaptive fusion of multiple characteristics (MAF-ADM) for the detection of low-intensity attacks was suggested by [PERSON] et al. [92] as a solution to this problem. Under a low-intensity attack, the time-frequency joint distribution of the legitimate TCP traffic changes; therefore, several statistical features of this distribution were selected to create isolation trees. The potential to isolate samples containing low-intensity attacks was then combined to create an anomaly score. The anomaly score was smoothed using a WMA to lower the potential number of errors that may result due to noise in the network traffic. The result shows that the method can effectively detect low-intensity attacks with a relatively low false negative rate when demonstrated on the WIDE2018 and LBNL datasets. The approach has two shortcomings. First, neither of the two datasets had evidence of low-intensity attacks; instead, this was simply assumed to exist. Second, the extraction of features requires very high data processing expenses and is time-consuming. These two drawbacks constrain its use for real-time online detection of low-intensity attacks. The authors in [93] used SES and wavelet analysis to track incoming bytes, packet counts, and the ratio of incoming to outgoing packets to detect UDP flooding DDoS attacks. This approach detects multiple attack scenarios without producing any false positives. The application of TES for TCP-SYN flood and slammer worm detection was reported in [94]. In this investigation, the traffic packets' source IP, destination IP, and ports were examined within a 900 s interval. The effectiveness of the approach was verified using the Brazilian National Research and Education Network dataset, which has 5 days of network traffic. Results indicated that the approach was successful in identifying TCP-SYN flooding. For this approach, the false alarm rate and detection accuracy were not assessed. Some other time series models, such as auto-regressive (AR), autoregressive integrated moving average (ARIMA), and linear regression model (LRM), are reportedly used for DDoS attack detection. [PERSON] et al.