## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.6 Machine Learning-Based Detection Methods
While SVM and k-NN have zero errors, some cases of errors were observed with J48 and RF. In addition, there is a great deal of variation in the processing times of these algorithms. It is noted that SVM requires the most testing time, whereas k-NN requires the least training time. Similar to this, the authors of [135] concentrated on the employment of more machine learning classifiers to detect DDoS attacks. In this method, six classifiers were evaluated for attack detection: logistic regression (LR), NB, k-NN, SVM, decision tree (DT), and RF. This contrasts with aprevious study [134] that simply used conventional flow features for attack detection. This approach used extended features. Evaluation results show that RF performs best in terms of detection accuracy, whereas k-NN records the worst performance. The accuracy of detection by RF is 99.76%, compared to 86.41% for k-NN. While the models can accurately detect attacks within a few seconds (specifically, less than 1 s), the probability of dropping normal traffic is also observed. [PERSON] et al. [136] investigated the application of machine learning models with recurrent neural network (RNN) and LSTM for attack detection on the BoT-IoT dataset. The features extracted from the dataset were classified into two categories. The top 10 features selected from a filter with a correlation coefficient and joint entropy make up the first category, while the second category has all 35 features in the dataset. The effectiveness of these models was evaluated based on this category. When the top 10 features were considered, the RNN performed better, with an accuracy of 99.74%, while the SVM performed the worst, with an accuracy of 88.37%. However, the SVM outperforms other models in terms of precision and processing time. When all 35 features were considered, the SVM had superior performance in terms of accuracy, precision, and processing times. The SVM records an accuracy of 99.99%. One of the shortcomings of this study lies in the dataset used. [PERSON] [137] reported that the dataset is unbalanced, which may have positively affected the identification of attacks due to data bias. The studies in [138] tried to solve the issue of dataset class imbalance resulting from the use of the BoT-IoT dataset in [136]. Using the same dataset as the previous study, several machine and deep learning methods were employed to create a novel DDoS and DoS attack detection method on an IoT network. These models included RF, DT, LSTM, gated recurrent units (GRU), MLP, RNN, and SVM. To prevent feature dependencies, the binary and multiclass classifications in this study used three separate feature sets. Evaluation results show that the RF and DT are more accurate for both binary and multiclass classifications. Both versions exhibit excellent performance across the board for every feature set. For instance, when the initial feature set for multiclass classification is considered, the DT model has an accuracy of 99.95%, whereas the RF model has an accuracy of 99.92%. When binary classification is considered, the accuracies for DT and RF rise to 99.97% and 99.95%, respectively. [PERSON] et al. [139] employed DT for DDoS attack detection in a multi-layer IoT environment. IoT gateways, cloud servers, SDN switches, and IoT devices make up the multi-layer IoT environment, as shown in Figure 14. In this study, eight smart poles were used to build a wireless sensor network that collected sensor data across a campus. Each smart pole was equipped with an LED lamp, an access point, a camera, smart signage, a communication box, and an equipment box. The study used Wi-Fi, Bluetooth, ZigBee, and LoRa to transmit sensor data. Smart poles SP1-SP4 equipped with Wi-Fi access points connected to the internet without a backbone connection, while SP4-SP8 smart poles required Ethernet to send and receive packets. Additionally, SP2 and SP3 supported ZigBee, SP5 supported Bluetooth, and SP2 and SP8 supported LoRa.