## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Anomaly-Based Methods
#### 3.3.7 Deep Learning-Based Detection Methods
[171] proposed a tailored deep learning approach for detecting attacks in an IoT environment. An embedding layer and an FNN approach were used in this study to perform multiclass attack prediction. Additionally, an FNN model was also developed to perform binary classification. Evaluation results reveal the success of the method. Both classifiers performed better. Particularly, the binary classifier showed detection accuracy close to 99.99%, while the multi-class classifier recorded about 99.79% accuracy. In this study, only a few attack classes were reportedly detected. Thus, detecting other forms of attack is not guaranteed. The study presented in [PERSON] et al. [172] discusses the use of an RNN with an autoencoder (AE) to improve detection accuracy during a DDoS attack in SDN. The success of this scheme was evaluated in comparison to NB, RF, DT, SVM, and linear regression classifiers. The scheme has a significant enhancement in terms of accuracy when demonstrated on the CICDDoS2019 dataset compared to existing approaches. The approach records an accuracy of 99%. The computational overhead was slightly reduced; the study, however, excluded reporting performance parameters such as model training time or samples classified. [PERSON] et al. [173] evaluated the effectiveness of CNN, LSTM, MLP, and a hybrid of CNN and LSTM (that is, CNN + LSTM) for attack detection in IoT networks. The effectiveness of these models was demonstrated using the CICIDS2017 dataset. The CNN + LSTM has the highest accuracy among these models, whereas the MLP has the lowest accuracy. LSTM performs second-best, with an accuracy of 96.24%, while CNN + LSTM achieves a detection accuracy of 97.16%. However, in terms of precision, the LSTM is observed to have the lowest precision results, while the MLP has the second-best performance. The study offers no justification for this obvious disparity. An AE-based unsupervised deep learning framework was proposed by [PERSON] et al. [174] for the fog computing layer. The fog node is where training and parameter updates are carried out. The stacked AE model was pre-trained with unlabelled data, and was subsequently used to classify test data. The effectiveness of the method was demonstrated on the NSL-KDD dataset, considering 41 features. An excellent accuracy of 99.2% and a detection rate of 99.27% were recorded. In this study, only a very few cases of false alarms were recorded. The performance of the suggested approach needs to be proven on more recent data because the dataset utilized are outdated. The study presented by the authors in [175] shows that a bidirectional long short-term memory-based RNN (BLSTM-RNN) could be effectively employed for attack detection. The performance of this approach was also compared to a unidirectional LSTM-RNN for the detection of botnet attacks. In this study, four attack vectors were considered in the generated dataset used for validation. These attack vectors include Mirai, UDP, DNS, and ACK. The method performed well in detecting Mirai, UDP, and DNS attacks with 99.0%, 98.0%, and 98.01% accuracies. When the ACK attack was considered, though, its performance deteriorated. This strategy has the significant drawback of adding computing overhead to each epoch, which increases the processing time. _Attack detection in UAVs/IoD/FANET using deep learning:_ In [14], the authors proposed a sea turtle foraging algorithm with a hybrid deep learning-based intrusion detection scheme (STFA-HDLID) for attack detection in an IoD environment. In this approach, the feature selection process was achieved with the STFA. Additionally, classification was performed using a Deep Belief Network (DBN) and the Sparrow Search Optimization (SSO) algorithm. The performance of the approach was demonstrated using the TON_IoT and UNSW-NB15 datasets. The results presented showed that an accuracy of 99.51 was recorded for the TON_IoT dataset, while 98.85% was achieved when the UNSW-NB15 dataset was considered.