## 3 DDoS Attack Detection Methods
### DDoS Attack Detection Studies Using Signature-Based Methods
#### 3.2.1 Traffic Pattern Analysis  
This method is predicated on the notion that infectious packets have the same behavioural patterns that are distinct from those of legitimate ones. For instance, in a botnet attack, a single bot master typically controls all the bots. The same patterns are seen due to requests being delivered to numerous botnet members, which is what is driving the behaviour. This method compares incoming traffic patterns to pre-established legitimate traffic profiles. Any deviation from these profiles indicates malicious traffic. A profile of legitimate traffic is obtained via traffic features recorded when the terminal generating the traffic is secure [49]. One major limitation with this approach is the imbalanced traffic flows \begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Methods** & **Features** & **Advantages** & **Limitations** & \\ \hline Traditional methods & Measures the volume of traffic. & \(\bullet\) & Fast detection speed & \(\bullet\) & Detection is based on thresholds. \\  & & & & \(\bullet\) & Stealth attacks cannot be detected. \\  & & & & \(\bullet\) & High false alarm rates. \\  & & & & \(\bullet\) & Low detection accuracy. \\ \hline  & & & & \(\bullet\) & Suffers from detection accuracy for variation of known attacks. \\  & Attacks are recognized using signatures of well-known detection attacks that have been stored in the database. & \(\bullet\) & High detection accuracy for known attacks. & \(\bullet\) & Unknown and zero-day attacks cannot be detected. \\  & & & & Low false positive rates & \(\bullet\) & Misrepresentation of signature patterns leads to increased false negative rates. \\  & & & \(\bullet\) & Fast detection speed & \(\bullet\) & Requires frequent update of the attack signatures in the database. \\ \hline  & & & & \(\bullet\) & Detection speed is relatively low. \\  & Establishes a baseline profile for normal traffic behavioural pattern collected over a predetermined period. & \(\bullet\) & Efficient for detecting unknown and zero-day attacks. & \(\bullet\) & Encrypted attack patterns have not been detected. \\  & & & & \(\bullet\) & Sometimes generate significant false alarm rates \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Overview of the DDoS attack detection classifications. due to the dynamic nature of internet traffic patterns. This might lead to the selection of flow features being incorrect [50]. Since traffic pattern analysis requires that the pattern of the network traffic be accurately characterized for better detection accuracy, machine learning algorithms are mostly employed. Thus, there are studies that assess the potential of machine learning classifiers for traffic pattern classification to improve DDoS attack detection. [PERSON] and [PERSON] [50] attempted to correctly classify internet traffic patterns for DDoS attack detection using Bayesian techniques and obtained 60% accuracy. In [51], network traffic samples collected using sflow protocol from network devices were classified and analysed using a random forest (RF) classifier. The network traffic was compared to signatures collected earlier from network traffic samples to make the detection. The method was tested using a synthesized dataset, comprised of the CIC-DoS, CICIDS2017, and CICIDS2018 datasets. According to the results, the method had a 96% detection rate, a relatively high level of precision, and a low false alarm rate. The detection method has certain inherent shortcomings. The comparison's traffic signatures were made using previously retrieved network traffic samples. However, since internet traffic loads change over time, it becomes harder to choose the right flow features, which leads to imbalanced traffic flows. [PERSON] et al. [52] categorized traffic features using a machine learning-based hybrid feature selection approach.