{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,13]],"date-time":"2026-08-13T16:15:31Z","timestamp":1786637731447,"version":"build-2736575974"},"reference-count":120,"publisher":"MDPI AG","issue":"15","license":[{"start":{"date-parts":[[2023,8,1]],"date-time":"2023-08-01T00:00:00Z","timestamp":1690848000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"MSIT (Ministry of Science and ICT), Korea","award":["IITP2021-2021-0-01835"],"award-info":[{"award-number":["IITP2021-2021-0-01835"]}]},{"name":"MSIT (Ministry of Science and ICT), Korea","award":["2021-0-00590"],"award-info":[{"award-number":["2021-0-00590"]}]},{"name":"MSIT (Ministry of Science and ICT), Korea","award":["P0008703"],"award-info":[{"award-number":["P0008703"]}]},{"name":"MSIT (Ministry of Science and ICT), Korea","award":["2021R1F1A1045861"],"award-info":[{"award-number":["2021R1F1A1045861"]}]},{"name":"Korean Government (MOTIE)","award":["IITP2021-2021-0-01835"],"award-info":[{"award-number":["IITP2021-2021-0-01835"]}]},{"name":"Korean Government (MOTIE)","award":["2021-0-00590"],"award-info":[{"award-number":["2021-0-00590"]}]},{"name":"Korean Government (MOTIE)","award":["P0008703"],"award-info":[{"award-number":["P0008703"]}]},{"name":"Korean Government (MOTIE)","award":["2021R1F1A1045861"],"award-info":[{"award-number":["2021R1F1A1045861"]}]},{"name":"Ministry of Education","award":["IITP2021-2021-0-01835"],"award-info":[{"award-number":["IITP2021-2021-0-01835"]}]},{"name":"Ministry of Education","award":["2021-0-00590"],"award-info":[{"award-number":["2021-0-00590"]}]},{"name":"Ministry of Education","award":["P0008703"],"award-info":[{"award-number":["P0008703"]}]},{"name":"Ministry of Education","award":["2021R1F1A1045861"],"award-info":[{"award-number":["2021R1F1A1045861"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Having a large number of device connections provides attackers with multiple ways to attack a network. This situation can lead to distributed denial-of-service (DDoS) attacks, which can cause fiscal harm and corrupt data. Thus, irregularity detection in traffic data is crucial in detecting malicious behavior in a network, which is essential for network security and the integrity of modern Cyber\u2013Physical Systems (CPS). Nevertheless, studies have shown that current techniques are ineffective at detecting DDoS attacks on networks, especially in the case of high-speed networks (HSN), as detecting attacks on the latter is very complex due to their fast packet processing. This review aims to study and compare different approaches to detecting DDoS attacks, using machine learning (ML) techniques such as k-means, K-Nearest Neighbors (KNN), and Naive Bayes (NB) used in intrusion detection systems (IDSs) and flow-based IDSs, and expresses data paths for packet filtering for HSN performance. This review highlights the high-speed network accuracy evaluation factors, provides a detailed DDoS attack taxonomy, and classifies detection techniques. Moreover, the existing literature is inspected through a qualitative analysis, with respect to the factors extracted from the presented taxonomy of irregular traffic pattern detection. Different research directions are suggested to support researchers in identifying and designing the optimal solution by highlighting the issues and challenges of DDoS attacks on high-speed networks.<\/jats:p>","DOI":"10.3390\/s23156850","type":"journal-article","created":{"date-parts":[[2023,8,1]],"date-time":"2023-08-01T09:32:35Z","timestamp":1690882355000},"page":"6850","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":32,"title":["High-Speed Network DDoS Attack Detection: A Survey"],"prefix":"10.3390","volume":"23","author":[{"given":"Rana M. Abdul","family":"Haseeb-ur-rehman","sequence":"first","affiliation":[{"name":"Center for Cyber Security, Faculty of Information Science and Technology, University Kebangsaan Malaysia (UKM), Bangi 43600, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7337-6736","authenticated-orcid":false,"given":"Azana Hafizah Mohd","family":"Aman","sequence":"additional","affiliation":[{"name":"Center for Cyber Security, Faculty of Information Science and Technology, University Kebangsaan Malaysia (UKM), Bangi 43600, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5511-0205","authenticated-orcid":false,"given":"Mohammad Kamrul","family":"Hasan","sequence":"additional","affiliation":[{"name":"Center for Cyber Security, Faculty of Information Science and Technology, University Kebangsaan Malaysia (UKM), Bangi 43600, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3627-556X","authenticated-orcid":false,"given":"Khairul Akram Zainol","family":"Ariffin","sequence":"additional","affiliation":[{"name":"Center for Cyber Security, Faculty of Information Science and Technology, University Kebangsaan Malaysia (UKM), Bangi 43600, Malaysia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7050-0532","authenticated-orcid":false,"given":"Abdallah","family":"Namoun","sequence":"additional","affiliation":[{"name":"Faculty of Computer and Information Systems, Islamic University of Madinah, Madinah 42351, Saudi Arabia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4871-4080","authenticated-orcid":false,"given":"Ali","family":"Tufail","sequence":"additional","affiliation":[{"name":"School of Digital Science, Universiti Brunei Darussalam, Tungku Link, Gadong BE1410, Brunei"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ki-Hyung","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Cyber Security, Ajou University, Suwon 16499, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2023,8,1]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"22347","DOI":"10.1109\/JSEN.2021.3090967","article-title":"Sensor cloud frameworks: State-of-the-art, taxonomy, and research issues","volume":"21","author":"Liaqat","year":"2021","journal-title":"IEEE Sens. J."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"260","DOI":"10.1016\/j.comnet.2016.08.017","article-title":"Cyber-physical systems clouds: A survey","volume":"108","author":"Ellouze","year":"2016","journal-title":"Comput. Netw."},{"key":"ref_3","first-page":"1","article-title":"Cisco annual internet report (2018\u20132023) white paper","volume":"10","author":"Cisco","year":"2021","journal-title":"Acessado Em."},{"key":"ref_4","unstructured":"Li, Q., Meng, L., Zhang, Y., and Yan, J. (2018). International Forum on Digital TV and Wireless Multimedia Communications, Springer."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"292","DOI":"10.1504\/IJDET.2019.097849","article-title":"Systematic literature review and taxonomy for DDoS attack detection and prediction","volume":"1","author":"Yusof","year":"2019","journal-title":"Int. J. Digit. Enterp. Technol."},{"key":"ref_6","first-page":"95","article-title":"An abnormal network flow feature sequence prediction approach for DDoS attacks detection in big data environment","volume":"55","author":"Cheng","year":"2018","journal-title":"Comput. Mater. Contin."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"502","DOI":"10.1049\/iet-ifs.2017.0500","article-title":"Detection and differentiation of application layer DDoS attack from flash events using fuzzy-GA computation","volume":"12","author":"Singh","year":"2018","journal-title":"IET Inf. Secur."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"106128","DOI":"10.1016\/j.engappai.2023.106128","article-title":"Resilient backstepping control for a class of switched nonlinear time-delay systems under hybrid cyber-attacks","volume":"122","author":"Akbari","year":"2023","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"2407","DOI":"10.1109\/TSG.2019.2953815","article-title":"Quantitative assessment of stochastic property of network-induced time delay in smart substation cyber communications","volume":"11","author":"Zheng","year":"2019","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"3581","DOI":"10.1109\/TSG.2021.3058682","article-title":"Learning-based simultaneous detection and characterization of time delay attack in cyber-physical systems","volume":"12","author":"Ganesh","year":"2021","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"112","DOI":"10.1016\/j.future.2020.01.049","article-title":"IPsec for high speed network links: Performance analysis and enhancements","volume":"107","author":"Ullah","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"1862","DOI":"10.1109\/TCCN.2022.3186331","article-title":"A Flow Based Anomaly Detection Approach with Feature Selection Method Against DDoS Attacks in SDNs","volume":"8","author":"Azer","year":"2022","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"3061","DOI":"10.1149\/10701.3061ecst","article-title":"Analysis of Defense Techniques for DDOS Attacks in IoT\u2014A Review","volume":"107","author":"Papalkar","year":"2022","journal-title":"ECS Trans."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"900","DOI":"10.18421\/TEM112-51","article-title":"A Systematic Review of the Intrusion Detection Techniques in VANETS","volume":"11","author":"Naqvi","year":"2022","journal-title":"TEM J."},{"key":"ref_15","first-page":"2458","article-title":"Intrusion detection systems: Principles and perspectives","volume":"4","author":"Almansor","year":"2018","journal-title":"J. Multidiscip. Eng. Sci. Stud."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"76648","DOI":"10.1109\/ACCESS.2022.3191430","article-title":"Detection and Mitigation of Low-Rate Denial-of-Service Attacks: A Survey","volume":"10","author":"Rios","year":"2022","journal-title":"IEEE Access"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"107726","DOI":"10.1016\/j.compeleceng.2022.107726","article-title":"Smart defense against distributed Denial of service attack in IoT networks using supervised learning classifiers","volume":"98","author":"Gupta","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"ref_18","unstructured":"Ennemoser, F.J., Sattler, P., and Zirngibl, J. (February, January 30). State of the Art of DDoS Mitigation Techniques. Proceedings of the Seminar IITM WS 21\/22, Munich, Germany."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"401","DOI":"10.1108\/eb045590","article-title":"Building local networks with hubs","volume":"15","author":"Falk","year":"1997","journal-title":"Electron. Libr."},{"key":"ref_20","unstructured":"Davis, E.L. (1995). Emerging High-Speed Local-Area Networks and Wide-Area Networks, SPIE."},{"key":"ref_21","unstructured":"Adrian, D., Durumeric, Z., Singh, G., and Halderman, J.A. (2014, January 19). Zippier ZMap: Internet-Wide Scanning at 10 Gbps. Proceedings of the WOOT 8th USENIX Workshop on Offensive Technologies, San Diego, CA, USA."},{"key":"ref_22","unstructured":"Arashloo, M.T., Lavrov, A., Ghobadi, M., Rexford, J., Walker, D., and Wentzlaff, D. (2020, January 25\u201327). Enabling Programmable Transport Protocols in High-Speed NICs. Proceedings of the NSDI, 17th USENIX Symposium on Networked Systems Design and Implementation, Santa Clara, CA, USA."},{"key":"ref_23","unstructured":"Naeem, M., Jamal, T., Diaz-Martinez, J., Butt, S.A., Montesano, N., Tariq, M.I., De-la-Hoz-Franco, E., and De-La-Hoz-Valdiris, E. (2022). Advances in Intelligent Data Analysis and Applications, Springer."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1201","DOI":"10.1007\/s10462-020-09874-x","article-title":"Data stream clustering: A review","volume":"54","author":"Atalay","year":"2021","journal-title":"Artif. Intell. Rev."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"187","DOI":"10.1016\/j.comnet.2018.11.033","article-title":"High-speed data plane and network functions virtualization by vectorizing packet processing","volume":"149","author":"Linguaglossa","year":"2019","journal-title":"Comput. Netw."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"549","DOI":"10.1016\/j.aej.2021.06.033","article-title":"Complex methods detect anomalies in real time based on time series analysis","volume":"61","author":"Alghawli","year":"2022","journal-title":"Alex. Eng. J."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"686","DOI":"10.1080\/19393555.2022.2035470","article-title":"Security Issues in Cloud and Mobile cloud: A Comprehensive Survey","volume":"31","author":"Srikanth","year":"2022","journal-title":"Inf. Secur. J. A Glob. Perspect."},{"key":"ref_28","first-page":"102582","article-title":"Computational intelligence intrusion detection techniques in mobile cloud computing environments: Review, taxonomy, and open research issues","volume":"55","author":"Shamshirband","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_29","unstructured":"Katal, A. (2022). Mathematical Modeling for Intelligent Systems, Chapman and Hall\/CRC."},{"key":"ref_30","unstructured":"Kalra, V., Rahi, S., Tanwar, P., and Sharma, M.S. (2022). Emerging Technologies for Computing, Communication and Smart Cities, Springer."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"102431","DOI":"10.1016\/j.artmed.2022.102431","article-title":"Ubiquitous and smart healthcare monitoring frameworks based on machine learning: A comprehensive review","volume":"134","author":"Motwani","year":"2022","journal-title":"Artif. Intell. Med."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"100485","DOI":"10.1016\/j.iot.2021.100485","article-title":"HealthCloud: A system for monitoring health status of heart patients using machine learning and cloud computing","volume":"17","author":"Desai","year":"2022","journal-title":"Internet Things"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"31","DOI":"10.35806\/ijoced.v3i1.139","article-title":"Commercial cloud services for a robust mobile application backend data storage","volume":"3","author":"Dahunsi","year":"2021","journal-title":"Indones. J. Comput. Eng. Des. (IJoCED)"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Lin, X., Ma, B., Wang, X., He, Y., Liu, R.P., and Ni, W. (2022, January 4\u20136). Multi-layer Reverse Engineering System for Vehicular Controller Area Network Messages. Proceedings of the 2022 IEEE 25th International Conference on Computer Supported Cooperative Work in Design (CSCWD), Hangzhou, China.","DOI":"10.1109\/CSCWD54268.2022.9776214"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Jan, S.A., Amin, N.U., Shuja, J., Abbas, A., Maray, M., and Ali, M. (2022). SELWAK: A secure and efficient lightweight and anonymous authentication and key establishment scheme for IoT based vehicular ad hoc networks. Sensors, 22.","DOI":"10.3390\/s22114019"},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"e247","DOI":"10.1002\/itl2.247","article-title":"COVID-19 pandemic cybersecurity issues","volume":"4","author":"Pranggono","year":"2021","journal-title":"Internet Technol. Lett."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"319","DOI":"10.1016\/j.ijinfomgt.2018.06.004","article-title":"An m-health application for cerebral stroke detection and monitoring using cloud services","volume":"45","author":"Parra","year":"2019","journal-title":"Int. J. Inf. Manag."},{"key":"ref_38","unstructured":"Mahajan, R., and Zafar, S. (2021). Data Analytics and Management, Springer."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"289","DOI":"10.1016\/j.ijinfomgt.2018.08.006","article-title":"Real-time big data processing for anomaly detection: A survey","volume":"45","author":"Habeeb","year":"2019","journal-title":"Int. J. Inf. Manag."},{"key":"ref_40","unstructured":"Shaik, A., and Borgaonkar, R. (2019, January 3\u20138). New vulnerabilities in 5G networks. Proceedings of the Black Hat USA Conference, Las Vegas, NV, USA."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"e5500","DOI":"10.1002\/dac.5500","article-title":"A systematic literature review of machine learning applications in IoT","volume":"36","author":"Gherbi","year":"2023","journal-title":"Int. J. Commun. Syst."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"6229356","DOI":"10.1155\/2022\/6229356","article-title":"5G-Telecommunication Allocation Network Using IoT Enabled Improved Machine Learning Technique","volume":"2022","author":"Alzaidi","year":"2022","journal-title":"Wirel. Commun. Mob. Comput."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Abranches, M., Michel, O., Keller, E., and Schmid, S. (2021, January 9\u201311). Efficient Network Monitoring Applications in the Kernel with eBPF and XDP. Proceedings of the 2021 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN), Heraklion, Greece.","DOI":"10.1109\/NFV-SDN53031.2021.9665095"},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"e3813","DOI":"10.1002\/ett.3813","article-title":"A lightweight and compromise-resilient authentication scheme for IoTs","volume":"33","author":"Aziz","year":"2022","journal-title":"Trans. Emerg. Telecommun. Technol."},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1007\/s11235-019-00599-z","article-title":"A survey of DDoS attacking techniques and defence mechanisms in the IoT network","volume":"73","author":"Vishwakarma","year":"2020","journal-title":"Telecommun. Syst."},{"key":"ref_46","unstructured":"Chou, E., and Groves, R. (2018). Distributed Denial of Service (DDoS), O\u2019Reilly Media, Incorporated."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Ahmad, R., Alsmadi, I., Alhamdani, W., and Tawalbeh, L.a. (2023). Zero-day attack detection: A systematic literature review. Artif. Intell. Rev., 1\u201379.","DOI":"10.1007\/s10462-023-10437-z"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"9965","DOI":"10.1007\/s13369-021-06484-9","article-title":"VMFCVD: An optimized framework to combat volumetric DDoS attacks using machine learning","volume":"47","author":"Prasad","year":"2022","journal-title":"Arab. J. Sci. Eng."},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"284","DOI":"10.1016\/j.cose.2019.01.002","article-title":"Efficient DDoS flood attack detection using dynamic thresholding on flow-based network traffic","volume":"82","author":"David","year":"2019","journal-title":"Comput. Secur."},{"key":"ref_50","doi-asserted-by":"crossref","first-page":"59","DOI":"10.1016\/j.aci.2017.10.003","article-title":"HTTP flood attack detection in application layer using machine learning metrics and bio inspired bat algorithm","volume":"15","author":"Sreeram","year":"2019","journal-title":"Appl. Comput. Inform."},{"key":"ref_51","doi-asserted-by":"crossref","first-page":"103079","DOI":"10.1016\/j.jnca.2021.103079","article-title":"A fast all-packets-based DDoS attack detection approach based on network graph and graph kernel","volume":"185","author":"Liu","year":"2021","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Yang, L., and Zhao, H. (2018, January 16\u201318). DDoS attack identification and defense using SDN based on machine learning method. Proceedings of the 2018 15th International Symposium on Pervasive Systems, Algorithms and Networks (I-SPAN), Yichang, China.","DOI":"10.1109\/I-SPAN.2018.00036"},{"key":"ref_53","doi-asserted-by":"crossref","unstructured":"Kirdan, E., Raumer, D., Emmerich, P., and Carle, G. (2018, January 19\u201321). Building a traffic policer for ddos mitigation on top of commodity hardware. Proceedings of the 2018 International Symposium on Networks, Computers and Communications (ISNCC), Rome, Italy.","DOI":"10.1109\/ISNCC.2018.8531043"},{"key":"ref_54","doi-asserted-by":"crossref","unstructured":"Ramanathan, S., Mirkovic, J., Yu, M., and Zhang, Y. (2018, January 3\u20137). SENSS against volumetric DDoS attacks. Proceedings of the 34th Annual Computer Security Applications Conference, San Juan, Puerto Rico.","DOI":"10.1145\/3274694.3274717"},{"key":"ref_55","first-page":"1283472","article-title":"Review of recent detection methods for HTTP DDoS attack","volume":"2019","author":"Jaafar","year":"2019","journal-title":"J. Comput. Netw. Commun."},{"key":"ref_56","doi-asserted-by":"crossref","first-page":"33","DOI":"10.36548\/jucct.2019.1.004","article-title":"DDOS attack detection in telecommunication network using machine learning","volume":"1","author":"Smys","year":"2019","journal-title":"J. Ubiquitous Comput. Commun. Technol. UCCT"},{"key":"ref_57","first-page":"110","article-title":"An Review on HTTP, TCP Flood, DDOS Attack in Cloud Environment & Their Solutions","volume":"8","author":"Kumar","year":"2020","journal-title":"Int. J. Sci. Res. Comput. Sci. Eng."},{"key":"ref_58","unstructured":"Choe, Y., Shin, J.-S., Lee, S., and Kim, J. (2022, January 2\u20134). eBPF\/XDP based network traffic visualization and dos mitigation for intelligent service protection. Proceedings of the International Conference on Emerging Internetworking, Data & Web Technologies, Okayama, Japan."},{"key":"ref_59","doi-asserted-by":"crossref","unstructured":"Dimolianis, M., Pavlidis, A., and Maglaris, V. (2020, January 24\u201327). A multi-feature DDoS detection schema on P4 network hardware. Proceedings of the 2020 23rd Conference on Innovation in Clouds, Internet and Networks and Workshops (ICIN), Paris, France.","DOI":"10.1109\/ICIN48450.2020.9059327"},{"key":"ref_60","first-page":"67","article-title":"Ddos mitigation: A review of content delivery network and its ddos defence techniques","volume":"6","author":"Imthiyas","year":"2020","journal-title":"Int. J. Perceptive Cogn. Comput."},{"key":"ref_61","doi-asserted-by":"crossref","unstructured":"Ghorbani, H., Mohammadzadeh, M.S., and Ahmadzadegan, M.H. (2020, January 20\u201321). DDoS Attacks on the IoT Network with the Emergence of 5G. Proceedings of the 2020 International Conference on Technology and Entrepreneurship-Virtual (ICTE-V), San Jose, CA, USA.","DOI":"10.1109\/ICTE-V50708.2020.9113779"},{"key":"ref_62","doi-asserted-by":"crossref","unstructured":"Peneti, S., and Hemalatha, E. (2021, January 27\u201329). DDOS Attack Identification using Machine Learning Techniques. Proceedings of the 2021 International Conference on Computer Communication and Informatics (ICCCI), Coimbatore, India.","DOI":"10.1109\/ICCCI50826.2021.9402441"},{"key":"ref_63","doi-asserted-by":"crossref","unstructured":"Awan, M.J., Farooq, U., Babar, H.M.A., Yasin, A., Nobanee, H., Hussain, M., Hakeem, O., and Zain, A.M. (2021). Real-time DDoS attack detection system using big data approach. Sustainability, 13.","DOI":"10.3390\/su131910743"},{"key":"ref_64","doi-asserted-by":"crossref","first-page":"2707","DOI":"10.1007\/s11277-021-08359-6","article-title":"Malicious traffic classification using long short-term memory (LSTM) model","volume":"119","author":"Thapa","year":"2021","journal-title":"Wirel. Pers. Commun."},{"key":"ref_65","doi-asserted-by":"crossref","first-page":"102107","DOI":"10.1016\/j.cose.2020.102107","article-title":"Low-rate DDoS attacks detection method using data compression and behavior divergence measurement","volume":"100","author":"Liu","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_66","first-page":"100048","article-title":"TaxoDaCML: Taxonomy based Divide and Conquer using machine learning approach for DDoS attack classification","volume":"1","author":"Thorat","year":"2021","journal-title":"Int. J. Inf. Manag. Data Insights"},{"key":"ref_67","doi-asserted-by":"crossref","first-page":"101","DOI":"10.1016\/j.ejcon.2021.07.001","article-title":"Adaptive tuning of network traffic policing mechanisms for DDoS attack mitigation systems","volume":"61","author":"Karpowicz","year":"2021","journal-title":"Eur. J. Control"},{"key":"ref_68","first-page":"1686","article-title":"Coda: Runtime Detection of Application-Layer CPU-Exhaustion DoS Attacks in Containers","volume":"16","author":"Zhan","year":"2022","journal-title":"IEEE Trans. Serv. Comput."},{"key":"ref_69","unstructured":"Szynkiewicz, P. (2022). Cybersecurity of Digital Service Chains, Springer."},{"key":"ref_70","unstructured":"Makita, T., Tu, W., and NSBU, N.V. (August, January 28). Faster OVS Datapath with XDP. Proceedings of the Netdev 0x14 Conference, Virtual."},{"key":"ref_71","unstructured":"Karlsson, M., and T\u00f6pel, B. (2018, January 13\u201315). The path to DPDK speeds for AF XDP. Proceedings of the Linux Plumbers Conference, Vancouver, BC, Canada."},{"key":"ref_72","doi-asserted-by":"crossref","unstructured":"Alashhab, A.A., Zahid, M.S.M., Azim, M.A., Daha, M.Y., Isyaku, B., and Ali, S. (2022). A Survey of Low Rate DDoS Detection Techniques Based on Machine Learning in Software-Defined Networks. Symmetry, 14.","DOI":"10.3390\/sym14081563"},{"key":"ref_73","unstructured":"Visky, G., and Vaarandi, R. (2022). Performance and Applicability Analysis of Open-source Intrusion Detection Systems in Special-purpose Networks. [Bachelor\u2019s Thesis, Tallinn University of Technology]."},{"key":"ref_74","doi-asserted-by":"crossref","unstructured":"Saleh, A.J.M., and Adnan, N. (2021, January 10\u201311). Denial-of-Service (DoS) Threat Detection Using Supervised Machine Learning Algorithms on CICIDS2018 Dataset. Proceedings of the International Conference on Fourth Industrial Revolution and Beyond 2021, Dhaka, Bangladesh.","DOI":"10.1007\/978-981-19-2445-3_36"},{"key":"ref_75","doi-asserted-by":"crossref","first-page":"13","DOI":"10.25195\/ijci.v48i1.349","article-title":"Review of Detection Denial of Service Attacks using Machine Learning through Ensemble Learning","volume":"48","author":"Abdulla","year":"2022","journal-title":"Iraqi J. Comput. Inform."},{"key":"ref_76","doi-asserted-by":"crossref","unstructured":"Oktivasari, P., Zain, A.R., Agustin, M., Kurniawan, A., Arbi Murad, F., and Fabian Anshor, M. (2022, January 13\u201314). Analysis of Effectiveness of Iptables on Web Server from Slowloris Attack. Proceedings of the 2022 5th International Conference of Computer and Informatics Engineering (IC2IE), Jakarta, Indonesia.","DOI":"10.1109\/IC2IE56416.2022.9970143"},{"key":"ref_77","doi-asserted-by":"crossref","unstructured":"Florea, R., and Craus, M. (2022, January 19\u201321). Modeling an Enterprise Environment for Testing Openstack Cloud Platform against Low-Rate DDoS Attacks. Proceedings of the 2022 26th International Conference on System Theory, Control and Computing (ICSTCC), Sinaia, Romania.","DOI":"10.1109\/ICSTCC55426.2022.9931822"},{"key":"ref_78","doi-asserted-by":"crossref","first-page":"1353","DOI":"10.1007\/s13369-021-05947-3","article-title":"Analysis of machine learning classifiers for early detection of DDoS attacks on IoT devices","volume":"47","author":"Gaur","year":"2022","journal-title":"Arab. J. Sci. Eng."},{"key":"ref_79","doi-asserted-by":"crossref","first-page":"3244","DOI":"10.1109\/TNSM.2021.3085097","article-title":"Seta++: Real-time scalable encrypted traffic analytics in multi-gbps networks","volume":"18","author":"Kattadige","year":"2021","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_80","doi-asserted-by":"crossref","first-page":"3469","DOI":"10.1109\/TII.2020.3022432","article-title":"Variational LSTM enhanced anomaly detection for industrial big data","volume":"17","author":"Zhou","year":"2020","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_81","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3371038","article-title":"Fast packet processing with ebpf and xdp: Concepts, code, challenges, and applications","volume":"53","author":"Vieira","year":"2020","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"ref_82","doi-asserted-by":"crossref","unstructured":"Tellis, V.M., and D\u2019Souza, D.J. (2018, January 23\u201324). Detecting anomalies in data stream using efficient techniques: A review. Proceedings of the 2018 International Conference on Control, Power, Communication and Computing Technologies (ICCPCCT), Kannur, India.","DOI":"10.1109\/ICCPCCT.2018.8574310"},{"key":"ref_83","doi-asserted-by":"crossref","unstructured":"Scholz, D., Raumer, D., Emmerich, P., Kurtz, A., Lesiak, K., and Carle, G. (2018, January 3\u20137). Performance implications of packet filtering with linux ebpf. Proceedings of the 2018 30th International Teletraffic Congress (ITC 30), Vienna, Austria.","DOI":"10.1109\/ITC30.2018.00039"},{"key":"ref_84","doi-asserted-by":"crossref","first-page":"473","DOI":"10.1016\/j.future.2018.09.051","article-title":"BigFlow: Real-time and reliable anomaly-based intrusion detection for high-speed networks","volume":"93","author":"Viegas","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_85","doi-asserted-by":"crossref","first-page":"3081","DOI":"10.1109\/TCYB.2019.2940940","article-title":"Data-driven cyber security in perspective\u2014Intelligent traffic analysis","volume":"50","author":"Coulter","year":"2019","journal-title":"IEEE Trans. Cybern."},{"key":"ref_86","doi-asserted-by":"crossref","first-page":"107161","DOI":"10.1109\/ACCESS.2019.2933491","article-title":"Introducing SmartNICs in server-based data plane processing: The DDoS mitigation use case","volume":"7","author":"Miano","year":"2019","journal-title":"IEEE Access"},{"key":"ref_87","first-page":"102426","article-title":"Analysing performance issues of open-source intrusion detection systems in high-speed networks","volume":"51","author":"Hu","year":"2020","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_88","doi-asserted-by":"crossref","unstructured":"Cassagnes, C., Trestioreanu, L., Joly, C., and State, R. (2020, January 20\u201324). The rise of eBPF for non-intrusive performance monitoring. Proceedings of the NOMS 2020-2020 IEEE\/IFIP Network Operations and Management Symposium, Budapest, Hungary.","DOI":"10.1109\/NOMS47738.2020.9110434"},{"key":"ref_89","doi-asserted-by":"crossref","first-page":"1401","DOI":"10.1007\/s12083-020-01036-8","article-title":"A novel spread estimation based abnormal flow detection in high-speed networks","volume":"14","author":"Bu","year":"2021","journal-title":"Peer\u2014Peer Netw. Appl."},{"key":"ref_90","first-page":"1","article-title":"A Multifunctional Full-Packet Capture and Network Measurement System Supporting Nanosecond Timestamp and Real-Time Analysis","volume":"70","author":"Han","year":"2021","journal-title":"IEEE Trans. Instrum. Meas."},{"key":"ref_91","doi-asserted-by":"crossref","unstructured":"Farshin, A., Barbette, T., Roozbeh, A., Maguire Jr, G.Q., and Kosti\u0107, D. (2021, January 19\u201323). PacketMill: Toward per-Core 100-Gbps networking. Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Virtual.","DOI":"10.1145\/3445814.3446724"},{"key":"ref_92","unstructured":"Salopek, D. (2022). Hybrid Hardware\/Software Datapath for Near Real-Time Reconfigurable High-Speed Packet Filtering. [Ph.D. Thesis, Faculty of Electrical Engineering and Computing, University of Zagreb]."},{"key":"ref_93","doi-asserted-by":"crossref","first-page":"1951","DOI":"10.1109\/TNSM.2022.3157888","article-title":"HARNESS: High Availability supportive Self Reliant Network Slicing in 5G Networks","volume":"19","author":"Vittal","year":"2022","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_94","unstructured":"Bonola, M., Belocchi, G., Tulumello, A., Brunella, M.S., Siracusano, G., Bianchi, G., and Bifulco, R. (2022, January 11\u201313). Faster Software Packet Processing on {FPGA}{NICs} with {eBPF} Program Warping. Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC 22), Carlsbad, CA, USA."},{"key":"ref_95","unstructured":"Wieren, H. (2019). Signature-Based Ddos Attack Mitigation: Automated Generating Rules for Extended Berkeley Packet Filter and Express Data Path. [Master\u2019s Thesis, University of Twente]."},{"key":"ref_96","first-page":"237","article-title":"SSL\/TLS Encrypted Traffic Application Layer Protocol and Service Classification","volume":"12","author":"Li","year":"2022","journal-title":"CS IT Conf. Proc."},{"key":"ref_97","unstructured":"Kumaigorodski, A., Lutz, C., and Markl, V. (June, January 19). Fast CSV loading using GPUs and RDMA for in-memory data processing. Proceedings of the Datenbanksysteme f\u00fcr Business, Technologie und Web (BTW 2021), Virtual."},{"key":"ref_98","doi-asserted-by":"crossref","first-page":"671","DOI":"10.1007\/s10766-021-00696-0","article-title":"RDMA-based apache storm for high-performance stream data processing","volume":"49","author":"Zhang","year":"2021","journal-title":"Int. J. Parallel Program."},{"key":"ref_99","unstructured":"Shapira, A., Zolfi, A., Demetrio, L., Biggio, B., and Shabtai, A. (2022). Denial-of-Service Attack on Object Detection Model Using Universal Adversarial Perturbation. arXiv."},{"key":"ref_100","first-page":"103212","article-title":"A low-rate DDoS detection and mitigation for SDN using Renyi Entropy with Packet Drop","volume":"68","author":"Ahalawat","year":"2022","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_101","unstructured":"Wang, T., Yang, X., Antichi, G., Sivaraman, A., and Panda, A. (2022, January 4\u20136). Isolation Mechanisms for High-Speed Packet-Processing Pipelines. Proceedings of the 19th USENIX Symposium on Networked Systems Design and Implementation (NSDI 22), Renton, WA, USA."},{"key":"ref_102","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1007\/s11325-021-02359-3","article-title":"Validation of snoring detection using a smartphone app","volume":"26","author":"Chiang","year":"2022","journal-title":"Sleep. Breath."},{"key":"ref_103","doi-asserted-by":"crossref","first-page":"75","DOI":"10.1007\/s10922-022-09687-z","article-title":"XDP-Based SmartNIC Hardware Performance Acceleration for Next-Generation Networks","volume":"30","author":"Wang","year":"2022","journal-title":"J. Netw. Syst. Manag."},{"key":"ref_104","unstructured":"Mart\u00ednek, T., Campanella, M., FBK, F.P., and Hill, J. (2022). White Paper: Timestamping and Clock Synchronisation in P4-Programmable Platforms, G\u00c9ANT."},{"key":"ref_105","doi-asserted-by":"crossref","first-page":"800","DOI":"10.1109\/TNSM.2019.2933358","article-title":"A survey on big data for network traffic monitoring and analysis","volume":"16","author":"Drago","year":"2019","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_106","unstructured":"Melnick, J. (Netwrix Blog, 2018). Top 10 most common types of cyber attacks, Netwrix Blog."},{"key":"ref_107","doi-asserted-by":"crossref","first-page":"661","DOI":"10.1109\/COMST.2018.2870658","article-title":"DDoS attacks at the application layer: Challenges and research perspectives for safeguarding web applications","volume":"21","author":"Praseed","year":"2018","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_108","doi-asserted-by":"crossref","first-page":"102380","DOI":"10.1016\/j.cose.2021.102380","article-title":"A review of amplification-based distributed denial of service attacks and their mitigation","volume":"109","author":"Ismail","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_109","unstructured":"Van Leeuwen, B., Gao, J., Yin, H.K., Anthony, B., and Urias, V. (2022). Networked-Based Cyber Analysis Using Deep Packet Inspection (DPI) for High-Speed Networks, Sandia National Lab (SNL-NM)."},{"key":"ref_110","doi-asserted-by":"crossref","first-page":"3645","DOI":"10.1109\/COMST.2018.2851072","article-title":"Fast packet processing: A survey","volume":"20","author":"Amamou","year":"2018","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_111","unstructured":"Deepak, A., Huang, R., and Mehra, P. (2018, January 13\u201315). eBPF\/XDP based firewall and packet filtering. Proceedings of the Linux Plumbers Conference, Vancouver, BC, Canada."},{"key":"ref_112","doi-asserted-by":"crossref","unstructured":"Li, Z. (2018, January 11\u201314). HPSRouter: A high performance software router based on DPDK. Proceedings of the 2018 20th International Conference on Advanced Communication Technology (ICACT), Chuncheon, Republic of Korea.","DOI":"10.23919\/ICACT.2018.8323809"},{"key":"ref_113","doi-asserted-by":"crossref","first-page":"108019","DOI":"10.1016\/j.compeleceng.2022.108019","article-title":"Software defined network-based HTTP flooding attack defender","volume":"101","author":"Mohammadi","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"ref_114","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1155\/2022\/8379532","article-title":"Prevention Techniques against Distributed Denial of Service Attacks in Heterogeneous Networks: A Systematic Review","volume":"2022","author":"Cheema","year":"2022","journal-title":"Secur. Commun. Netw."},{"key":"ref_115","doi-asserted-by":"crossref","first-page":"203","DOI":"10.1016\/j.comcom.2019.06.010","article-title":"Active learning to detect DDoS attack using ranked features","volume":"145","author":"Deka","year":"2019","journal-title":"Comput. Commun."},{"key":"ref_116","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., Hakak, S., and Ghorbani, A.A. (2019, January 1\u20133). Developing realistic distributed denial of service (DDoS) attack dataset and taxonomy. Proceedings of the 2019 International Carnahan Conference on Security Technology (ICCST), Chennai, India.","DOI":"10.1109\/CCST.2019.8888419"},{"key":"ref_117","unstructured":"Boeder, C., and Januchowski, T. (2022). Zero-day DDoS Attack Detection. arXiv."},{"key":"ref_118","doi-asserted-by":"crossref","unstructured":"Black, S., and Kim, Y. (2022, January 26\u201329). An Overview on Detection and Prevention of Application Layer DDoS Attacks. Proceedings of the 2022 IEEE 12th Annual Computing and Communication Workshop and Conference (CCWC), Las Vegas, NV, USA.","DOI":"10.1109\/CCWC54503.2022.9720741"},{"key":"ref_119","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1080\/19393555.2020.1853855","article-title":"A systematic review and taxonomy of web applications threats","volume":"31","author":"Sadqi","year":"2022","journal-title":"Inf. Secur. J. A Glob. Perspect."},{"key":"ref_120","unstructured":"Liu, Z., Namkung, H., Nikolaidis, G., Lee, J., Kim, C., Jin, X., Braverman, V., Yu, M., and Sekar, V. (2021, January 11\u201313). Jaqen: A High-Performance Switch-Native Approach for Detecting and Mitigating Volumetric DDoS Attacks with Programmable Switches. Proceedings of the 30th USENIX Security Symposium (USENIX Security 21), Online."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/15\/6850\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T20:23:58Z","timestamp":1760127838000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/23\/15\/6850"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8,1]]},"references-count":120,"journal-issue":{"issue":"15","published-online":{"date-parts":[[2023,8]]}},"alternative-id":["s23156850"],"URL":"https:\/\/doi.org\/10.3390\/s23156850","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,8,1]]}}}