## 1 Introduction
DDoS attacks against Internet servers' application layers have increased recently, costing their targets huge amounts of money [9]. Attacks at the TCP/IP layer limit the number of requests per second and overwhelm the online server. These include DDoS attacks, zero-day attacks, and slowloris attacks that exploit vulnerabilities in Windows or Apache [10]. Only a limited number of DDoS incidents at the application layer are captured by the solutions provided to comprehend DDoS attacks at the TCP/IP layer. The formula for the resolutions that identify all kinds of application-layer assaults is extremely complex. The lack of landscapes to detect DDoS attacks is one set of challenges in detecting a DDoS out-break at the TCP/IP layer [11]. All web servers are vulnerable to HTTP-GET DDoS assaults since bots can mimic people and make it hard to distinguish harmful queries from legitimate ones. DDoS attacks are increasingly targeting businesses worldwide, regardless of their size or industry. As more systems are admitted, vulnerabilities remain unpatched, and the impact on business grows, the complexity and intensity of these attacks are growing rapidly [12]. The cyber realm is significantly impacted by DDoS attacks. Due to IP overflow, bandwidth spoofing, high memory usage, and root sane or mouse damage, cyberattacks are anticipated to interfere with organizations' normal operations [13]. With its traffic, a slow-moving DDoS assault can simulate actual traffic. Avoiding detection by existing systems is easy. Rank correlation algorithms can identify important distinctions between legitimate and attack traffic based on their rank values [14]. Information servers, Internet servers, and cloud computing servers are all severely impacted by DoS attacks [15]. Among the most common threats are Botnets, DDoSs, hacking, malware, pharming, phishing, ransomware, spam, spoofing, and spyware [16]. IBM CEO [PERSON] claims that a cyberattack poses the greatest threat to any or all companies globally. As a result, cybercriminals are on the rise [14]. Malicious people compromise client servers using a variety of techniques. It is difficult to detect DDoS attacks since they are quite diverse and happen in between other cyberattacks. Additionally, a diverse range of online applications have been integrated with various web services, encompassing domains such as e-commerce, online banking, online shopping, online education, e-healthcare, and Industrial Control Systems (ICSs) for critical infrastructure, among others [17]. Botnets are a set of devices infected by Malicious codes with the aim of overwhelming a certain website or service. Botnets refer to overlay networks that consist of compromised mobile devices owned by users. Botnets of this nature are managed by individuals known as Bot masters, who are cyber criminals responsible for the creation and dissemination of these Botnets. Email attachments are a prevalent method of infecting devices. These attachments are commonly associated with Trojan viruses. Once the machine is infected by the malware, it establishes a connection with a designated central server referred to as Command Control (CC), or alternatively, with a peer-to-peer network that constitutes the botnet [17]. Given the limited processing and memory resources for IoT devices, it becomes impossible for users to install anti-virus software on it. In addition, the large number of IoT devices makes it a desirable target for attackers to enslave IoT devices in their botnet Malicious networks [18]. Markov chains have lately been used to predict events. In fact, they have been successfully applied in a number of disciplines, including engineering, physics, meteorology, and medicine, to either prevent or mitigate the effects of disasters [19]. Markov chains are helpful for simulating complex scenarios and predicting the likelihood of future events. Markov chains have been used to predict a number of possible disasters, such as earthquakes, tsunamis, and even the spread of disease [20].