## 5 Key Findings and Discussions  
In this section, the lessons learned from the survey are presented. An increasing amount of research shows the significance of this field. The research studies cover the use of traditional and more sophisticated deep learning approaches for attack detection. Traditional approaches such as LADS and MULTOPS have a fast detection speed, since only the measured traffic volume is compared against a pre-defined threshold. The major challenge is the choice and selection of the right threshold. As observed in the study presented in [55], only a few traces of DDoS attacks can be detected when a threshold established at 26 Mbps is used on an ISP network. The threshold selection issues make this approach prone to false alarms, which affect the detection accuracy. Therefore, the applicability of this approach to present-day security threats is constrained by detection accuracy and false alarm rates. The approach based on the correlation of the attacker's and the target server's IP addresses is very simple, as it only compares non-uniformity in the IP addresses. This makes the approach record excellent accuracy for attack detection, as noted in the research studies in [55; 56; 57; 58]. This is not the case with modern attack strategies, where the same IP address can be used to launch attacks. The attack is launched in such a way that there is no significant dispersion of the IPs, which makes the correlation coefficient unaffected. This makes it difficult for an attack to be detected using this approach. Several other studies [49; 50; 51; 52; 53; 54] have focused on the use of network traffic patterns to identify anomalies, since attack traffic will have a different pattern from that of legitimate ones. Despite the good precision recorded by this method, as reported in [50; 51; 52], the approach suffers from inaccurate flow feature selection. In view of this, machine learning, for example [53], is used to overcome this limitation. A major bottleneck reported is the difficulty in detecting attacks when the protocol headers are encrypted. Research studies have also demonstrated the use of queue modelling [76; 77; 78; 79; 80; 81; 82], Chisquare [86; 87; 88; 89], and chaos-based [116; 117; 118; 119; 120; 121] approaches for DDoS attack detection, with some level of success. DDoS attack detection based on queue modelling has a fast response time once the maximum length of the queue is exceeded. The method, meanwhile, struggles with detecting accuracy under large-scale DDoS attacks. Additionally, this method frequently has significant false negative rates. The assumptions of independence used in Chi-square methods rarely apply to packet field values, even under normal conditions. As a result, it is possible that the Chi-square method does not accurately estimate how far a current traffic profile deviates from the baseline. Additionally, this method does not match real-life traffic patterns over an internet-enabled network. It is well known that the frequency of each symbol, which provides packet header information such as the source IP and packet length, exhibits power law behaviour [206]. The chi-square equation obeys the (B-1) degrees offreedom of the \(\chi^{2}\) distribution. As a result, directly adapting the \(\chi^{2}\) method for incoming packets is difficult. In the chaos-based DDoS attack detection studies, it is observed that an estimate of the Lyapunov exponent in the network traffic orbit is used to determine the attack. The exponent is calculated during a time window. As a result, the detection accuracy is severely influenced by the window size selection. A study published by [89] revealed that a small window size is sufficient to identify an amplification attack, but at the expense of computational resources. Although the authors in [207] investigated a detection algorithm for fixing the detection window size, the detection accuracy is relatively low, with some missed cases.