Scholarlink

<p>Application layer Distributed Denial of Service (ALDDoS) attacks are an increasing threat to online services because they imitate normal user behavior while overloading server resources. This survey reviews 47 primary studies published since 2018 and provides a structured and comprehensive overview of ALDDoS attack categories, including high rate attacks, low rate attacks, and flash crowd events, along with the detection methods used for each type. The findings show a growing shift toward machine learning based detection techniques (31%), followed closely by hybrid methods (28.6%) and deep learning approaches (28.6%). In contrast, rule based techniques are declining and appear in only 11.9% of the reviewed studies. The survey also shows that CICIDS2017 and CICIDS2019, created by the Canadian Institute of Cybersecurity, are the most commonly used datasets, along with several custom datasets designed for specific research scenarios. In addition, the review identifies important features used to distinguish normal traffic, attack traffic, and flash crowd events, examines feature selection strategies, and highlights future research directions. By organizing existing knowledge on DDoS threats, this survey aims to support researchers and cybersecurity professionals in developing more effective and adaptive defense mechanisms against evolving attack strategies.</p>

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

A Survey of Application Layer Distributed Denial of Service Detection: Approaches, Models, and Datasets

  • 期刊论文

  • 出版模式：

    开放获取

  • 发表日期：

    2026年3月19日

查看全文
  • Tsion Fekadu Deressu,
  • Asrat Mulatu Beyene,
  • Ashenafi Yadessa Gemechu

摘要

Application layer Distributed Denial of Service (ALDDoS) attacks are an increasing threat to online services because they imitate normal user behavior while overloading server resources. This survey reviews 47 primary studies published since 2018 and provides a structured and comprehensive overview of ALDDoS attack categories, including high rate attacks, low rate attacks, and flash crowd events, along with the detection methods used for each type. The findings show a growing shift toward machine learning based detection techniques (31%), followed closely by hybrid methods (28.6%) and deep learning approaches (28.6%). In contrast, rule based techniques are declining and appear in only 11.9% of the reviewed studies. The survey also shows that CICIDS2017 and CICIDS2019, created by the Canadian Institute of Cybersecurity, are the most commonly used datasets, along with several custom datasets designed for specific research scenarios. In addition, the review identifies important features used to distinguish normal traffic, attack traffic, and flash crowd events, examines feature selection strategies, and highlights future research directions. By organizing existing knowledge on DDoS threats, this survey aims to support researchers and cybersecurity professionals in developing more effective and adaptive defense mechanisms against evolving attack strategies.