Distributed Denial of Service Attacks against Cloud Computing Environment: Survey, Issues, Challenges and Coherent Taxonomy

Abstract

Cloud computing (CC) plays a significant role in revolutionizing the information and communication technology (ICT) industry, allowing flexible delivery of new services and computing resources at a fraction of the costs for end-users than traditional computing. Unfortunately, many potential cyber threats impact CC-deployed services due to the exploitation of CC’s characteristics, such as resource sharing, elasticity, and multi-tenancy. This survey provides a comprehensive discussion on security issues and challenges facing CC for cloud service providers and their users. Furthermore, this survey proposes a new taxonomy for classifying CC attacks, distributed denial of service (DDoS) attacks, and DDoS attack detection approaches on CC. It also provides a qualitative comparison with the existing surveys. Finally, this survey aims to serve as a guide and reference for other researchers working on new DDoS attack detection approaches within the CC environment.

1. Introduction

Cloud computing (CC) enables the flexible delivery of services and computing resources through the Internet, including data storage, computation, networking, and software resources on demand. The elastic feature of the CC allows the resources to be dynamically allocated whenever needed without a large investment in infrastructure and software licensing for the users [1].

However, the same feature that makes CC flexible is also responsible for exposing it to security threats. One of the most serious threats is distributed denial of service (DDoS) attacks. Unfortunately, the impact of DDoS attacks on CC has not been investigated enough although there is some research that provides an in-depth examination of the above-said issue, shedding light on HTTP flooding DDoS attacks in the CC environment and various DDoS attacks [2].

CC has significant advantages over traditional computing, including lower capital and operational expenditures (CapEx and OpEx) and the ability to deliver dynamic and extensible virtualized computing resources [3,4]. Many recent research and surveys anticipated a dramatic rise in CC adoption based on past trends. For example, in the past three years, 75 percent of business applications allowed direct access to the application programming interface (API) of their most critical applications [5]. In upcoming years, 90 percent of large commercial IT companies will focus on CC. However, researchers believe that the coronavirus (COVID-19) pandemic could increase that percentage further [2,6].

Internet usage has increased by 50% in several European countries and 30% in the United Kingdom, reflecting the growth in the ICT sector spurred by surges in demands for online-based utilities and services. As a result, more issues and threats with CC will surface in due time, such as security and privacy breaches, data storage issues in the CC, and application-layer attacks [7,8]. Nowadays, major attacks on CC are growing, and the effects on its security are becoming more apparent. For example, attacks include malicious attempts by adversaries to deny legitimate users from obtaining services offered by the targeted servers [9].

Cloud service providers (CSP) charge their clients based on the services rendered or resources utilized on a pay-per-use basis. A new form of DDoS attack, called Economic denial of sustainability (EDoS), manipulates the CC charging model to hurt the financial bottom line of the users and the CSPs [10] by targeting the resource utilization at the application layer. EDoS attack is an economic security threat on the CC [10], which differs from a typical DDoS attack. DDoS attacks aim for service availability by debilitating the server’s resources until the server crash or are unresponsive; however, EDoS exploits the resource flexibility provided by the CC to force over-consumption of resources [11,12].

The COVID-19 pandemic has affected everybody since 2020, from individuals to businesses, public services, and educational institutions. At the same time, the pandemic also drives the demand for online services, including CC. So, it is rational to assume that it would also increase DDoS attack incidents and could be even more prominent going forward. Several surveys investigated DDoS attacks on CC and their effects in the effort to find solutions to secure the CC. Unfortunately, the existing surveys fall short of covering all parameters and taxonomies in this field. Therefore, this paper attempts to fill in the missing gaps.

This survey has the following contributions: (i) a qualitative comparison between this survey and the existing surveys in similar areas; (ii) a proposal of an author-defined taxonomy of attacks, DDoS attacks, and DDoS detection approaches on the CC environment; (iii) a comprehensive review of different types of DDoS attacks on CC and the techniques to detect them; and (iv) detailed explanations on the security issues and challenges of CC on the security, technological, and technical aspects.

The rest of the paper is organized as follows: the explanation of CC and DDoS attacks is in Section 2. Section 3 discusses security issues and challenges in CC. Section 4 provides a qualitative comparison between this work and existing surveys. Section 5 provides the proposed taxonomy of the attacks, DDoS attacks, and DDoS attack detection approaches on CC. Section 6 touches on influential factors for choosing a DDoS attack detection strategy on CC. Section 7 analyses critical discussion. Finally, the conclusion and future work are provided in Section 8.

2. Background

Security of CC is a major concern for both CSP and users. Several attacks, such as denial of service (DoS), DDoS, and EDoS, threaten the security of CC. This section introduces CC, DoS, and DDoS attacks.

2.1. Cloud Computing

CC is a realization of a long-held concept known as computing-as-utility, which emerges with enormous potential. The CC as a utility allows online services to be accessible whenever, wherever, and to anybody through the Internet, and most importantly, inexpensive and straightforward deployment. As a result of adopting this technology, the popularity of web applications is expected to experience dramatic growth in the near future. The CC’s fundamental trait is revolutionizing the IT field, and it will be the next great leap of innovation after the Internet. CC consolidates the IT infrastructure, network services, and applications with the resources of a data center (DC) using extensible virtualization technology, resulting in flexible, scalable [10], load-balanced, and instant on-demand services to cloud computing client (CCC), allowing the CSP to charge CCC usage accordingly [13].

The rise of present-day web-based applications with strict requirements demands a continuous improvement to the CC model to deliver services. The CC service models are usually categorized into three fundamental classifications, as shown in

Table 1. Summary of CC service models.

Service Models	Ownership Level	Control Level	Example
SaaS	End Clients	Can use the app but cannot control it or the server, storage, operating system (OS), network interface card (NIC), antivirus, etc.	Google and Microsoft applications
PaaS	Software Developer	Can create and control own app but cannot control the OS, NIC, antivirus, etc.	GAE, Microsoft’s Azure
IaaS	Infrastructure Architects	Can create and control own app, OS, NIC, antivirus, etc.	GoGrid, Flexiscale, Layered Technologies, and Rackspace

. The three service model categories are: (i) software-as-a-service (SaaS) where the clients use CSP application on the CC infrastructure, (ii) platform-as-a-service (PaaS) where developers develop and deploy applications on the CSP’s development platform, and (iii) infrastructure-as-a-service (IaaS) where the CSPs provide storage units, networks, virtual machines (VM) and other essential computing resources based on pay-per-use [14,15]. Many businesses adopt some forms of CC models to assist users in their business operations to their fullest while reducing cost.

Table 2. Summary of CC deployment models.

Deployment Models	Ownership	Services
Private	Owned by Single Company	Serve Internal Clients
Public	Owned by Single Company	Serve General Public
Community	Owned by Specific Community	Serve to Specific Community
Hybrid	Owned by a private company or/and owner of CSP	Serve to the general public and internal clients

[14] summarizes the four deployment models of CC service: (i) private, (ii) public, (iii) community and (iv) hybrid.

2.2. Overview of DoS and DDoS Attacks on CC

A DoS attack is a malicious attempt by an adversary using a single attacking host to prevent the targeted victim from accessing the required services or a node providing a service to its consumers. On the other hand, a DDoS attack involves multiple attacking hosts flooding the victim’s network or host with attack packets, resulting in a distributed multi-point attack [16].

There are several types of DoS attacks, and the most popular is the one targeting the client’s network bandwidth or connectivity. Bandwidth attacks significantly impact network performance by depleting all available network bandwidth, delaying or preventing users’ requests from being fulfilled. Meanwhile, connectivity attacks overwhelm the victim’s server with many application-layer requests, exhausting all available resources. As a result, the server stops responding to legitimate user requests.

DoS attacks are classified as follows: (i) flood attack involves an adversary sending a large volume of continuous stream of packets to the victim, depleting the victim’s resources and exhausting the victim’s bandwidth. (ii) vulnerability attack involves an adversary exploiting a vulnerability in the victim’s system and sending crafted messages to cause a DoS. The DDoS attack is frequently carried out by flooding the targeted system or network with a huge volume of traffic from multiple sources [17].

2.2.1. DoS, DDoS Attacks on CC

Adversaries launch DDoS attacks by sending a large volume of seemingly normal packets, making them difficult to detect. It is transmitted to the victim machine for embezzling the applications or protocol execution on the victim [18,19]. DDoS attacks that disrupt users’ connectivity by exhausting the network bandwidth and reducing the router’s processing capacity fall under the network-layer attack category. On the other hand, the attacks that deny legitimate user access to services by exhausting the VM resources (e.g., input/output bandwidth, sockets, central process unit (CPU), disk/database bandwidth, and memory) are application-layer (Level 7) attacks [20]. Application-layer attacks target servers’ applications or services by attempting to fully exhaust their resources by creating as many transactions and processes in the shortest time possible. Application-layer attacks are most challenging to detect and overcome because the generated transactions, such as HTTP requests, are indistinguishable from those by legitimate users. DDoS attacks are executed via a remotely controlled network, distributed and well-organized, so that compromised machines called zombies can be utilized for transmitting a huge volume of simultaneous requests to continuously attack the target system.

The widespread adoption of CC causes the number of attacks to also skyrocketed. The commonality of the CC structure’s features and components makes it more susceptible to attacks, especially DoS and DDoS. Adversaries typically aimed their DoS or DDoS attacks at CSP with many linked devices because its scalability and dependability make the CC accessible anywhere at any time. DDoS attacks typically involve many malicious packets directed to the target to keep it busy. With traditional networks, there are many strategies to defend against DDoS attacks; however, it is more challenging in the CC environment due to unique CC properties making the defense difficult. This study will look into the existing methods for detecting, preventing, and mitigating DDoS attacks in CC environments [21].

Organizations can leverage the CC to obtain on-demand, elastic, and fully managed computer system resources and services. However, any attacks, especially DoS and DDoS, on CC could cause substantial losses for CSPs and users. Successful DDoS attacks have serious consequences, such as poor user experience, service failures, and, in the worst-case scenario, complete shutdown and financial repercussions. DDoS attacks have grown in volume, regularity, and ferocity as the popularity of the internet of things (IoT) and widespread network connectivity have inadvertently fueled their growth [15].

Fast-growing web-based apps are typically developed and deployed within the CC environment. CC significantly reduces the cost of monitoring and maintaining IT infrastructure. The control and management of CC resources are usually reliant on standard networking protocols, allowing administrators to manage and control a distributed IT infrastructure centrally. Unfortunately, using standard networking protocol also will enable adversaries to get unauthorized access if the security is lacking or weak. Attacks like DDoS are among the most common threat in private CCs, resulting in degradation or denial of services [22].

DDoS attacks against application-layer services are not new. The first well-known DDoS attack appears to have occurred in August 1999 against a higher educational institution in the United States. It has since been directed at other sectors, including CNN, eBay, Yahoo, and Amazon [9]. In 2009, a DDoS attack disrupted many popular online services, including Facebook, Live Journal, Twitter, and Amazon [8]. Circa 2014, there were more than 7000 DDoS attacks launched daily [23]. The first quarter of 2013 saw the average attack volume at about 50 Gbps, up 718 percent from the last quarter of 2012 [23,24]. The largest DDoS attack recorded in history occurred at the end of 2016, involving a botnet called Mirai [25] that infected the servers of Dyn, a corporation dealing with a domain name system (DNS). In addition, the attack duration keeps increasing. For example, until the last quarter of 2020, no attack lasted more than 302 h. However, the longest attack in the first quarter of 2021 was 746 h (more than 31 days), then surpassed by a 776-h onslaught (more than 32 days) in the second quarter. One projection for the global market of DDoS protection systems [26] for 2022 predicts the value to expand from $3.3 billion in 2021 to $6.7 billion by 2026.

2.2.2. Impact of HTTP-GET Flooding DDoS Attacks on CC

CC security is crucial for maintaining service availability to end users. Typically, CCCs obtain CC services from CSP via the HTTP protocol, which is susceptible to misconfigurations and vulnerable to attacks if not properly secured. Clients acquiring online services from CSP via HTTP are often subjected to HTTP-GET flooding DDoS attacks. The HTTP-GET flood attack is similar to DDoS attacks, except instead of using data packets, it overloads the server with a large volume of HTTP-GET requests [27]. During an adversary-initiated HTTP flood attack, the attacker may use rented or own servers to bombard HTTP GET/POST requests to the targeted victim’s VM, leading to a significant increase in resource consumption and losses for the victim. Finally, the targeted host is overburdened and swamped by HTTP flood attacks, compromising the entire CC. HTTP flood attack is challenging to detect because it uses valid HTTP requests to the web server [28] to overrun VM resources. Furthermore, HTTP-GET flood attack traffic is difficult to differentiate from real traffic because they use regular uniform resource locator (URL) queries at a normal rate. Because the traffic volume in HTTP-GET flood attacks is often below the thresholds of most rate-based detection approaches, the attack goes undetected [29]. Additionally, attackers use valid HTTP packets without any anomaly in the packet’s structure or flags, whereas the IDS is mostly designed to detect a malformed or anomalous combination of flags. The consequence of this attack is an EDoS attack because the CC’s auto-scaling feature exacerbates the damage by allowing the CSP to provide an excessive pool of resources to CCCs to fulfill the service-level agreements (SLA). The limit set on the CCC’s pay-per-use invoicing system could prevent excessive user charges; however, it could also shut down many CC services with a single attack. Detecting HTTP-GET flood DDoS attacks in the CC environment requires a thorough understanding of the attacks and users’ behaviors.

3. Security Issues and Challenges

As the popularity of CC services increases and becomes more widely used, so will the security issues and challenges. This section discusses the security issues and challenges of the CC.

3.1. Security Issues

CC has several security issues, such as misuse and excessive utilization of resources, malicious insiders, insecure and unreliable APIs, data corruption or leak, account takeover, and shared technology vulnerabilities [30,31]. Other serious risks to the security of CC are DoS and DDoS attacks [9,31], as indicated by an ongoing CSA research [32]. A properly secured CC ensures the security of the website it hosts and vice versa [33]. The demand for CC security is becoming increasingly noticeable and outstanding. Even though the security of CC is at its nascent stage and still developing, an assortment of CC clients is already demanding various security requirements, which can vary for each CSP; even the same client could have different security requirements. The CC clients can be individuals, academic institutions or corporations, and software developers; every one of them might have specific security prerequisites. According to several researchers [34,35], the following are the security issues related to CCC and CSP:

• Data-related issues: The CSPs must guarantee the security and availability of the data transferred by the CCCs and prevent any conceivable security breaches. The owners of CSPs should utilize solid security approaches to ensure data availability and security. For example, there are various authorization approaches to control data, such as isolating clients’ data in the CC storage unit so that nobody other than the authorized client can access the data or modify its availability.
• Data integrity: In an independent system, data integrity can be guaranteed by taking into consideration atomicity, consistency, isolation, and durability (ACID) properties. It should be possible through decentralizing approach by utilizing a central manager. However, data integrity on CC is a big challenge. The greatest challenge with web services at the application layer is transaction management since the HTTP protocol cannot provide an ensured and available service. So, the best choice is to leave this on the level of API. In any case, available standards, such as transaction of web services and reliability of web services, are not yet developed. The absence of control at the data level could bring about significant integrity issues.
• Availability: It is crucial to maintain the availability of CC applications for better user accessibility. Therefore, CSPs must guarantee non-stop service to their CCC, including expansibility to support the business continuity of their users.
• Privileged user access: It is common for CCC to keep sensitive data in the CC; therefore, users require various levels of privileges to access that information. There must be a control system for accessing information for different users.
• Data recovery and backup: By providing backup services, CSPs should guarantee clients’ data recoverability caused by disasters or accidental damage. The backup data should be replicated on multiple distributed servers while maintaining integrity and privacy, allowing data to be restored whenever needed.
• Investigative support: Investigating incidents in the CC environment is difficult if the logging data constantly moves over multi-sites. CCC must obtain contractual obligations from the CSP to investigate every inappropriate or criminal event.
• Long-term viability: CCC should obtain a guarantee that their data is consistently accessible to them, even after an alteration or changes in the CSP policies and terms.
• Network security: CSPs are required to ensure data security during transit or network transfers to prevent critical or sensitive information leakage.
• Web application security: Services on CC must be overseen over the website utilizing the internet browser. Every security imperfection in the service application influences all the CCCs using the same service application. Even though they do not successfully process the security issue, numerous conventional security approaches exist.
• Virtualization: VMs that do not have a proper disconnection procedure may inadvertently permit a guest client to run codes on the hypervisor. The multi-tenancy property of the VM provides an opportunity for adversaries to breach the enforced security by exploiting the weaknesses in the VM to obtain unauthorized data from another VM on CC.
• Identity management (ID): ID management allows the system to recognize and manage clients, such as controlling their permission-based access. ID administration should be configurable to comply with the corporation rules [36].
• PaaS-related issues: PaaS allows CSP to let CCCs create an application through the platform service. The owners of CSP are accountable if there is illicit data move between the applications. The hypervisor is the responsibility of CSP owners. PaaS CSP is more elastic and adaptable than SaaS CSP, but at the expense of security, exposing it to cyber-attacks.
• IaaS related issues: VM in IaaS service model may encounter security issues. According to the CC service model, the security duties and accountability of CSP and CCC vary enormously.
• Economics DoS attacks: One of the sundry characteristics of CC is taking care of the scalability issues. The CCC’s service bill increases dramatically without reasonable grounds. Such a covert kind of attack that releases through DDoS attacks towards CC yet with an alternate malignant target is the EDoS attack.
• Denial of service: One of the most significant security threats confronting CC is DDoS attacks. DDoS attacks render services, such as web applications, unavailable to legitimate users. Adversaries are usually the instigator of such attacks by employing various readily available tools to make the targeted services inaccessible to users. One example of an application layer DDoS attack on CC is an HTTP-GET flood attack.

3.2. Challenges on CC

The CC faces many challenges, which can be summed up as but are not limited to technological and technical challenges and security challenges. Addressing those challenges requires the alignment of CC with business goals to ensure business continuity, user satisfaction, and effectiveness.

3.2.1. Technological and Technical Challenges of the CC

Setting up a CC on the Internet is a challenging endeavor. The awareness of these challenges would provide an understanding of the difficulties in ensuring comprehensive security for CC. The following are the technological and technical challenges that CSP may encounter:

• The heterogeneity: CC comprises an assortment of hardware manufactured by different manufacturers. For example, network switches, appliances, firewalls, and gateways could utilize proprietary communication protocols or operating systems.
• The deployment model: The deployment model refers to a specific kind of CC, essentially featured by proprietorship, access, and size, so forth. Public CCs; community CCs; private CCs; and hybrid CCs.
• The replica/DR: It should be borne in mind that there should be a duplicate of the original of the same CC in another geographical area, such as disaster recovery (DR) in the event of an earthquake or something similar.
• Communication: Different technologies are utilized by CC devices, for example, wireless or wired communications.
• The homogenization: For diversified CC devices to connect, team up and exchange data with one another, there ought to be a standardized and foreordained data interchange form.
• Energy consumption: One of the major challenge of the CC. Any device operating on CC needs to be intended and prepared with the matter.
• Energy continuity: An uninterruptible power supply (UPS) is an electrical device that supplies backup power when the main power supply source (generator or direct) fails.

3.2.2. The Security Challenges of the CC

Undoubtedly the most challenging aspect for CC is security. Despite deploying different security measures to secure CC, there are still many challenges for CSP to tackle [37], as follows:

• The threats from inside and outside: Malicious threats from outside the firm are dangerous to CSPs because the attacks are unpredictable and could cause severe damage to CSPs and CCCs. However, insider threats are considered the most dangerous since the adversaries emerge from within the company that provides CC service.
• The superlative between public CC and on-premises CC (private): The best protection to dramatically reduce attacks is to utilize on-premises CC, which is less complex than public CC. At the same time, they are costly and disregard the principal motivation behind CC.
• The multi-tenant: In the greater generality of the owners of CSP, a single hypervisor includes numerous VM that belong to multiple CCCs. These are called hosted VM and can be the contender of one another or followed by adversities to attack another VM. It expands the chance of an attack and, subsequently, inserts the challenge of innovating a secured approach.
• The access from the web: CC is powerless against a wide scope of application-layer attacks, like injection attacks of the structured query language (SQL), and HTTP flood attacks. There ought to be appropriate significant knowledge about safety efforts for software developers. The advancement life cycle of software should incorporate the security control technique into SaaS improvement.
• The guarantee hypervisor: The hypervisor or virtual machine manager (VMM) oversees and manages various OS running on a single metal server that is participated by the CCCs. The primary mission of VMM is to allot the resources to the OS or VM linked to a CCC. A VMM must protect the VM boundaries. Any security issues or attacks on VMM will compromise the security of the VM hosted on the physical servers.
• The network scope dynamics and protocols: Services provided by the CC are assorted, complicated, and elastic, which could potentially create numerous security issues. Therefore, security mechanisms, such as IDS and intrusion prevention systems (IPS) for detecting and preventing attacks on CC are required [38].

4. Qualitative Comparison with Existing Surveys on Detection Approaches of DDoS Attacks on CC

Several existing review papers discuss DDoS attack detection techniques. This section provides a qualitative comparison between our survey with the existing ones to highlight its originality.

Table 3. Qualitative comparison between this work and existing surveys.

Scope of Work	This Work	Other Survey Works (A Brief Discussion Only)
		[13]	[39]	[40]
Taxonomy of Attacks on CC
Suffocative	✓	✗	✗	✗
Protocol	✓	✗	✗	✗
Application Layer	✓	✗	✗	✗
Economically	✓	✗	✗	✗
Permanent Economic	✓	✗	✗	✗
Taxonomy of DDoS Attacks on CC
SYN Floods	✓	✓	✓	✗
UDP Floods	✓	✓	✗	✗
Ping of Death	✓	✓	✓	✗
ICMP Flood	✓	✓	✗	✗
HTTP Flood	✓	✓	✗	✗
Taxonomy of DDoS Attacks Detection Approaches
Signature Based (Used for Recognizing the Network Attacks)	✓	✗	✗	✗
Anomaly-based (Used for Recognizing the Network Attacks)	✓	✗	✗	✗
Hybrid-based (Used for Recognizing the Network Attacks)	✓	✗	✗	✗
Entropy-based (Deployed in Application Layer)	✓	✗	✗	✗
Filtering Tree (Deployed in Application Layer)	✓	✗	✗	✗
Parameters for Determining DDoS Attacks Solution
The real-time Response Detection mechanism	✗	✓	✗	✓
Over-Under Mitigate	✗	✓	✗	✓
Reporting	✗	✓	✗	✓
Performance Degradation	✗	✓	✗	✓
Ability to Auto-scale	✗	✓	✗	✓
Throughput	✗	✓	✗	✓
Request Response Time	✗	✓	✗	✓
Zero-Day Attack Detection Ability	✗	✓	✗	✓
Efficient	✓	✗	✗	✗
Accurate	✓	✓	✗	✗
Lightweight	✓	✗	✗	✗
Easy	✓	✗	✗	✗
Functional	✓	✗	✗	✗

lists the metrics used for qualitative comparison, namely: (i) taxonomy of attacks on CC; (ii) taxonomy of DDoS attacks on CC; (iii) taxonomy of DDoS attacks detection approaches, and (iv) parameters for determining DDoS attacks.

We proposed these metrics after thoroughly reviewing many existing DDoS detection techniques. Such a comparison is necessary to comprehend the fundamental aspects surrounding DDoS attacks on CC in order to propose a more efficient detection method. This survey is benchmarked with three existing reviews [13,39,40].

This survey paper accomplishes the basic objective of gathering work from various research papers. It introduces the existing research on CC security broadly and quickly. Since it is challenging and time-consuming to comprehend the entire research area, this survey attempts to assist the effort by introducing a thorough rundown of the state-of-the-art literature in one place.

5. Proposed Taxonomy of the Attacks, DDoS Attacks, and DDoS Detection Approaches on CC

Figure 1 depicts the proposed taxonomies of attacks, DDoS attacks, and DDoS attack detection approaches on CC. Together, they provide a better perspective on DDoS attacks on CC, allowing researchers to utilize them to solve many security issues on CC. For example, researchers can address the threat of HTTP flood DDoS on CC by understanding, separating, and focusing on the crucial elements of attack and detection approaches.

5.1. Taxonomy of the Attacks on CC

The CC is defenseless in the face of several attacks that provide serious security dangers. The threat of an attack is determined by the target of the adversary’s attack. The CC service availability can be disrupted partially or entirely for a short or long period. The attacks of CC can be classified into four categories based on the attack’s target, as shown in Figure 1. The categories are suffocative attacks, protocol attacks [41], and two new categories proposed in this survey paper: EDoS and Permanent Economic Attacks.

Table 4. Attacks on CC based on two questions.

Attacks on CC	What Are They Doing?	How Does the Victim Become Paralyzed?
Suffocative Attacks	They utilize tremendous traffic to saturate the target’s infrastructure-level bandwidth.	The attack generates huge traffic to deny access to the resource (e.g., Web service). The attack volume is generally calculated in packets/sec or bit/sec. Example: TCP flood, user datagram protocol (UDP) Flood/Storm, DNS amplification, network time protocol (NTP) amplification, and Internet Control Message Protocol (ICMP) flood or Ping flood [42].
Protocol Attacks	Attacks that make a target inaccessible by exploiting the vulnerabilities of the infrastructure-level bandwidth of the victim (in the network layer and transport layer protocol stack).	An attack on the protocol takes up all processing power in the targeted device or resource, like a firewall. Example: Synchronize Flood (Neptune), Smurf DDoS attacks, Ping of Death [9,42]
Economic Denial of Sustainability (EDoS)	Attacks that exploit CC’s resource utilization, aiming to impact the CSP or CCC’s financial bottom line (e.g., to increase the bill), but not its physical network or server resources. It forces CSP to keep increasing its resource utilization to fulfill the SLA of its clients to the point it is economically non-viable or unable to sustain further demand for services.	These economical attacks target CCCs’ resource utility costs to increase.
Permanent Economic Attacks	It can also be found locally on CC devices or other devices, vulnerable or misconfigured firmware, and binaries. It targets the firmware, deletes all files, and re-configures network settings. If a system has not been sufficiently patched and upgraded, the probability of failure increases. Firmware is deliberately changed to corrupt the machine as a whole.	It attempts to destroy or modify hardware or component. For example, one-shot attacks exploit applications’ firmware upgrade mechanisms to inflict harm remotely via various means, such as phishing.

shows the relationship of these attacks and two questions: Q1—What are they doing? and Q2—How does the victim become paralyzed?

5.1.1. Suffocative Attacks

Suffocative attacks are those that are bandwidth-based or involve volumetric attacks. This attack overloads the targeted system with garbage data to consume the bandwidth of the targeted network system, flooding the network and affecting system resources. Its magnitude is measured in bits per second (Bps). Adversaries can launch this attack using UDP, ICMP flooding, or flooding the target with various spoofed packets [42].

5.1.2. Protocol Attacks

Protocol attacks consume real server resources and equipment used for networking communication, like load balancer (LB) devices or protection devices. The protocol attack is measured in packets per second (Pps). It exploits the weaknesses of network protocols to increase the burden on the victim’s resources. Some examples of protocol attacks include a smurf attack, fragmented packet attack, SYN floods, and ping of death [43]. Figure 2 illustrates the topology of a smurf attack.

5.1.3. Economic Denial of Sustainability (EDoS)

A type of DDoS attack on CC that impacts the financial bottom line of victims is called an EDoS attack [44]. It is a malicious attack specific to the CC that focuses on impacting the CSP’s OpEx more than the physical resources. It exploits the CC’s elastic or auto-scaling characteristic by attacking targeted services, especially on the application layer, forcing maximum consumption of CC resources until the services become inaccessible. Avoiding this situation requires the CSP to keep providing additional resources to fulfill the SLA for the CCC accessibility, which increases the cost for the CSP [33,45], resulting in EDoS [2]. Figure 3 illustrates how EDoS attacks on CC resources impact service availability.

Adversaries could trigger DDoS attacks on CC networks or resources using legitimate service requests to generate EDoS attacks [45]. In other words, the basis of this financial damage came from DDoS attacks (the result of EDoS is DDoS attacks usually, and the opposite is also true) that exploited available resources to increase the bill. The bloated cost has to be borne by the CSP or passed along to their clients.

5.1.4. Permanent Denial-of-Service Attacks

Permanent denial-of-service (PDoS) or Plashing is a fast-moving attack designed to disable the victim’s and prohibit it from providing services. This type of cyber attack, a strain of DDoS attacks with more emphasis on the victim’s hardware, started to increase in frequency in 2017 as more occurrences involving this hardware-damaging attack were found [46,47]. Furthermore, PDoS aims to cause perpetual harm to network equipment via programming, especially configurable network hardware, such as routers. Although PDoS attacks are rare, successful attacks are highly damaging to CC resources to the point of requiring the replacement or re-installation of equipment. Unlike DDoS attacks that disable a service temporarily, PDoS causes permanent hardware damage. It exploits the CC’s security flaws or misconfigurations in the remote administration function on the hardware management interface to alter the device’s firmware with a faulty version, damaging the device to the extent that requires fixing or even destroying essential system functions. All CC resources, such as LB, firewalls, VM, physical servers, storage units, and processors, are vulnerable to PDoS attacks [48]. Moreover, since a PDoS attack focuses on the hardware, it requires far fewer resources than a DDoS attack. PDoS is more destructive and has been gaining popularity among adversaries. CSP encountering a PDoS attack will incur business loss since services will be affected, and it could take a very long-time fixing fault. For instance, in 2009, the federal bureau of investigation (FBI) raided DCs in Texas because of fraud against several organizations that worked from out of the DCs [49]. In another case, a significant information loss occurred to a CSP providing storage services in Magnolia after experiencing Omni drive failure, leading to its shutting down without notice in 2008.

A Help Net Security site ran a report [50] on a universal serial bus (USB) device that disables a machine just by putting it into the USB port. According to the report, the most recent PDoS USB attack works by injecting some electrical power through the machine with the help of a voltage transformer to release a flood of negative electricity into the USB port. An example of a PDoS USB device is PhlashDance, built by Rich Smith in his security lab in 2008 to exhibit the inner working of a PDoS attack [51].

5.2. Taxonomy of DDoS Attacks on CC

DDoS attacks on CC have rapidly risen to the top of most cyber security threats lists. Attacks on CC could affect not only the CSP but also CC resources, including VMs and the networks [52]. Nevertheless, whatever the motive of an adversary to carry out DDoS attacks, any deterioration in services offered to CCC decreases its value.

CERT experts (a variety of researchers) say most DDoS attacks against the CERT target the application layer. The vast majority of DDoS attacks use a tremendous amount of requests of a standard communication protocol, making them hard to detect. Furthermore, they typically use well-known patterns to imitate legitimate traffic to throw off detection attempts. Therefore, standard network security strategies are not well suited to detect or prevent such attacks.

The attacks on CC are commonly classified into five categories, as illustrated in Figure 1 and summarized in

Table 5. DDoS attacks on CC.

DDoS Attack	Attack Aim	Source IP Address	Attack Method	OSI Layer	Impacts of Attack
SYN Flood	Protocol exploiting resource depletion	Spoofed	Not using malformed packets. Exploits TCP’s three-way handshaking	L4	Attack consumes VM’s resources, leading to EDoS attacks
UDP Flood	Protocol exploited bandwidth depletion attack	Spoofed	Not using malformed packets. Sends an oversize stream of UDP packets to a specific or random port of a target	L4	Attacks consume network bandwidth, leading to EDoS attacks
Ping of Death	Resource depletion using malformed packets	Spoofed	Using malformed packets. Sends data packet that exceeds maximum packet size	L3	Attacks cause a buffer overflow and system crash, leading to EDoS attacks
ICMP Floods	Protocol exploited bandwidth depletion attack	Spoofed	Not using malformed packets. Exploits ICMP’s ECHO REQUEST packet	L3	Attacks saturate network bandwidth, leading to EDoS attacks
HTTP Flood	Protocol exploiting resource depletion	Real (Not Spoofed)	Not using malformed packets. Exploits HTTP GET and POST request	L7	Attacks consume all VM’s resources, leading to EDoS attacks

.

5.2.1. SYN Floods

An adversary executes SYN flood attacks on CC by sending SYN requests using a spoofed source IP address, forcing the VM to respond and allocate the necessary resources to handle the requests. The VM waits for an acknowledgment from the ‘sender’ that never arrives. Continuous attacker’s requests finally exhaust the VM of all its resources, such as memory and CPU [31]. Consequently, the VM is forced to reject all subsequent user requests, including the legitimate ones, as illustrated in Figure 4.

5.2.2. UDP Floods

In this attack, the network bandwidth of CC is fully exhausted, although no user exists. Adversary injects a huge number of UDP packets into the network [12], as illustrated in Figure 5.

5.2.3. Ping of Death

A ping of death (PoD) attack involves an adversary using unusually large packets to cripple the CC’s VM or resources. The adversary changed the ping instruction by modifying the Fragment Offset field in the IP header to create a packet larger than the maximum permissible value for that field, which is 65,536 bytes. A ping packet with a size larger than the limit set by TCP/IP could overflow the buffer of the destination OS [53], affecting the victim’s computer connected to the CC networks and influencing the CC services linked to those networks. However, nowadays, all modern network equipment and OS ignore 65,535-byte IP packets that may cause a crash or slowdown of the OS, making today’s network and machines less susceptible to this attack. Figure 6 illustrates the PoD attack.

5.2.4. ICMP Flood Attack

ICMP messages are used to locate hosts on a network, map network structure, and determine the OS in use. It can also be used as a vehicle for various DDoS attacks on CC. For example, an adversary could crash the targeted host with ICMP Echo Request (ping) packets by broadcasting them quickly without waiting for replies, similar to the UDP flood attack principle. The targeted VM’s resources would deplete rapidly, affecting the VM’s availability. All Internet protocols permit specific data packets. In this attack, the destination CC resources or VM receives more data packets than the protocol allows, forcing the TCP/IP stack to fragment all data packets on the sender side and assemble them on the receiving side. When large amounts of fragmented data must be reassembled, the destination system’s performance will suffer. In other words, adversaries flooded the victim machine by sending a huge number of ICMP echo requests. When the infected machine tries to respond, the maximum bandwidth used will be near the maximum amount. As a result, legitimate users could not connect to the CC network. When the CCC tries to send the reply, adversaries send an ICMP echo request packet. The bandwidth utilization will reach the maximum, and new users cannot connect to the network during this time [54]. Furthermore, the adversary could leverage a compromised CC device as an intermediary to send ICMP echo requests to flood the local network, resulting in an insider attack. Figure 7 depicts the ICMP flood attack.

5.2.5. HTTP Flood

The application layer is vital for CC since the CSPs deliver many essential services to their users using application layer protocols, such as HTTP. HTTP is the primary application layer protocol used by web servers. Since CC usually hosts many web application servers, a massive number of HTTP requests can easily overwhelm web services. An example of an application layer attack is an HTTP flood. In an HTTP flood, the attackers may send enormous volumes of malicious HTTP requests to the victims to exhaust the resources and services running in the cloud and cause an EDoS attack, which is explained in Section 5.1.

A client, via a web browser or terminal, “talks” to a VM or web application server by sending a POST or GET request. The client uses POST queries to access dynamic resources, while GET requests retrieve static information like images. The two main categories of HTTP flood attacks are HTTP-POST and HTTP-GET. Attackers could overwhelm a targeted site or VM with HTTP-GET requests using valid packets without reflection or spoofing. Because many requests are sent to the web application server, and the VM generates many more responses than the zombie army receives, this attack is achievable by small botnets [19].

In this situation, an attacker sends an HTTP-GET request to the target application to test its availability. If the attacker receives an acknowledgment from the target application, the attacker transmits new HTTP-GET requests successively without waiting for acknowledgments. Since the web application server does not filter HTTP-GET requests to check if they are legitimate or not [55], it will continue accepting and processing the requests. Figure 8 illustrates the HTTP-GET flood attack mechanism.

Table 5 summarizes five different DDoS attacks on CC: SYN flood, UDP flood, ping of death, ICMP flood, and HTTP flood. These attacks mostly impacted layers 3, 4, or 7 of the open systems interconnection (OSI) model, impacting VM’s resource consumption and bandwidth utilization and causing a buffer overflow.

Table 6. Summary of attacks: their location, tools, and impacts.

Attack Sort	BB	AL	Pr	Eco	HF	Attack Tools	Impacts
ICMP Flood	✓	✗	✓	✓	✗	LOIC [56], XOIC [57]	Resource Depletion
ICMP Flood	✓	✗	✓	✓	✗	Stacheldraht [58], TFN [59], Shaft [60], Black Energy [61], Hgod [62]	Bandwidth, Resource Depletion
ICMP Flood	✓	✗	✓	✓	✗	Mstream [60]	Bandwidth Depletion
SYN Flood	✓	✗	✓	✓	✗	TFN, LOIC, DDOSIM [63], Py-loris [64], XOIC, Aldi Botnet [65]	Resource Depletion
SYN Flood	✓	✗	✓	✓	✗	Shaft, Kaiten [66], Knight [67], Black Energy, Hgod	Bandwidth, Resource Depletion
SYN Flood	✓	✗	✓	✓	✗	Mstream, Trinoo [68]	Bandwidth Depletion
UDP Flood	✓	✓	✓	✓	✗	LOIC, DDOSIM, Pyloris, XOIC	Resource Depletion
UDP Flood	✓	✓	✓	✓	✗	Stacheldraht, Trinity [69], TFN, Shaft, Kaiten, Knight, Black Energy, Hgod	Bandwidth, Resource Depletion
UDP Flood	✓	✓	✓	✓	✗	Mstream, Trinoo	Bandwidth Depletion
HTTP Flood	✗	✓	✓	✓	✗	LOIC, DDOSIM, Pyloris, Aldi Botnet, R-U DEAD-YET (R.U.D.Y) [70], HOIC, HULK [71], XERXES [72]	Resource Depletion
HTTP Flood	✗	✓	✓	✓	✗	Black Energy, TOR’s Hammer [73]	Bandwidth, Resource Depletion
HTTP Flood	✗	✓	✓	✓	✗	Trinoo	Bandwidth Depletion
HTTP Flood	✗	✓	✓	✓	✗	DAVOSET [74], Silent-Ddoser [75], UFONET [76]	Bandwidth, Resource Depletion
Slowloris	✗	✓	✓	✓	✗	Plyloris	Bandwidth, Resource Depletion
Smurf	✓	✗	✗	✓	✗	Nemesis [77]	Bandwidth, Resource Depletion
Zero-day	✓	✓	✓	✓	✗	Any tool	Bandwidth, Resource Depletion
EDoS	✗	✗	✗	✓	✗	All of the above and others contribute to	Bandwidth, Resource Depletion
PDoS	✗	✗	✗	✗	✓	PhlashDance [51]	Permanent damage to the hardware

Bandwidth Based: BB, Application Layer: AL, Protocol: Pr, Economically: Eco, Hardware Function: HF.

summarizes various attacks, their target areas, attack tools, and their impact, while

Table 7. DDoS attack Datasets.

Refs/Year	Dataset Name	Sort of Traffic	OSI L3	OSI L4	OSI L7
[78]/1995	University of Saskatchewan’s weblogs	HTTP	✗	✗	✓
[79]/1995	NASA Kennedy Space Center Florida web server logs	HTTP	✗	✗	✓
[80]/1995	ClarkNet Internet Service Provide Web server logs	HTTP	✗	✗	✓
[81]/1995	University of Calgary’s Computer Science Department weblogs	HTTP	✗	✗	✓
[82]/1995	San Diego Supercomputer Center (SDSC)	HTTP	✗	✗	✓
[83]/1995	Environmental protection agency-hypertext transfer protocol (EPA/EPA-HTTP)	HTTP	✗	✗	✓
[84]/1998	FIFA World Cup	HTTP (flash crowd)	✗	✗	✓
[85]/98-2000	MIT Lincoln	TCP	✗	✓	✗
[86]/1999	KDD Cup	TCP	✗	✓	✗
[87]/2001	UCLA	UDP	✗	✓	✗
[88]/2001	ATADS	HTTP (flash crowd)	✗	✗	✓
[89]/2001	Chilean presidential election	HTTP (flash crowd)	✗	✗	✓
[90]/2007	CAIDA	ICMP	✓	✗	✗
[91]/2009	Waikato	UDP	✗	✓	✗
[92]/2009	DARPA	HTTP, SMTP, DNS, TCP	✗	✓	✓
[93]/2009	Realistic Global Cyber Environment (RGCE)	HTTP, TCP	✗	✓	✓
[94]/2010	HTTP DATASET CSIC 2010	HTTP	✗	✗	✓
[95]/2012	TUIDS	ICMP, TCP, UDP	✓	✓	✗
[96]/2013	FRGP NTP Flow Data	NTP	✗	✗	✓
[97]/2013	CC Availability- 20130311	ICMP, HTTP	✓	✗	✓
[98]/2014	Booter	DNS	✗	✗	✓
[96]/2014	FRGPS SDP	SSTP, UDP, ICMP	✓	✓	✗
[99]/2015	UNSW-NB15 Coburg Intrusion Detection Dataset	TCP	✗	✓	✗
[100]/2017	CIDDS-001 CIDDS-002	ICMP, TCP, UDP, HTTP	✓	✓	✓
[101]/2017	CICIDS2017	HTTP/S, SMTP, POP3, IMAP, SSH, FTP	✗	✗	✓
[97]/2018	DITLBRoot – 20180410	DNS	✗	✗	✓
[102]/2018	CSE-CIC-IDS2018 on AWS	HTTP/s, SMTP, POP3, IMAP, SSH, FTP	✗	✗	✓
[103]/2019	CICDDoS2019	DNS, TFTP, WebDDoS, etc.	✓	✓	✓
[104]/2020	AIT Log Data Set	WebServer, WebMail, smtp, etc.	✗	✗	✓

lists the existing DDoS attack datasets since 1995.

5.3. Taxonomy of DDoS Attack Detection Approaches on CC

Several approaches have been proposed to detect DDoS attacks on CC. In this section, we propose a taxonomy of DDoS attack detection approaches on CC, broadly classified into five approaches, as shown in Figure 1.

5.3.1. Signature-Based Detection

Signature-based, misused-based, or rule-based approaches detect a DDoS attack if the incoming packets or traffic patterns match the predefined signatures or rules in its attack signatures database [105]. The drawback of these approaches is they cannot detect zero-day attacks.

The authors in [106] outlined the design of an offline signature-based network IDS that uses distributed processing and a Naive Bayesian classifier to detect DoS and DDoS attacks against HTTP servers. They or other researchers should do more work to build an inline IDS to identify attacks in real time. Because the current technique can only detect known attacks, more research is needed to detect new ones. The performance of the Naïve Bayesian classifier, having different classification methods, was evaluated on a testbed, achieving 97.82% classification accuracy for slow read attacks and 96.46% detection accuracy for normal behavior.

Anitha and Malliga [107] attempted to solve the problem of HTTP and XML Denial of Service (HX-DoS) attacks using CLASSIE, a rule-based detection system, and the modulo marking approach, which prevents spoofing attacks. For decision and packets dropping on the victim side, the Reconstruct and Drop method is employed. It helps improve the detection and filtering of DDoS attacks while lowering the false-positive rate. These attacks can be quickly detected on the adversary side by utilizing a packet-based marking mechanism. It can be filtered using the discovered packets on the victim side by dropping the marked packets. As a result, the overhead of packet marking and the false-positive rate of DoS attacks are considerably decreased.

Wang et al. [12] presented a dataset shift attack detection system based on a graphic model. The simulation findings suggest that their architecture can deal with the security difficulties posed by the new network paradigm effectively and efficiently. Additionally, the simulation result indicates that their attack detection system can effectively report numerous threats using real-world network traffic.

They proposed a new IPS service that uses signature-based devices, known as service-based intrusion prevention systems in CC (SIPSCC), to prevent SQL injections on CC websites (CCW). They used three VMs to test a model. Their implementation proposes, investigates, and evaluates SIPSCC from three perspectives: vulnerability detection, average time, and false positives. The suggested technique identifies and prevents key vulnerabilities in CCW [108].

Khatri and Khilari [109] proposed an architecture that includes the implementation of Suricata IDS for securing virtualized servers on CC and the validation of the IDS in detecting DDoS attacks against virtualized environments, effectively protecting the CC from vulnerabilities.

Sangeetha et al. [110] proposed combining a multi-threaded network IDS (NIDS) and host IDS (HIDS) to provide an efficient, quick, and secure HIDS. Cloud-IDS now captures packets from the network, analyses them, and sends reports to the CC Administrator based on the analysis. The K-Nearest neighbor and neural network (KNN-NN) hybrid classifier analyze packets. Further, the NSL-KDD dataset is used for training and testing purposes. After receiving the notification from Cloud-IDS, the CSP will alert the user and keep a log list of the malicious IP addresses. This approach effectively manages huge data packets, analyses them, and generates reports while detecting anomalies and misuse.

The E-CARGO model [111] is used to present a collaborative intrusion detection architecture. The components of an IDS are described by the common intrusion detection frame (CIDF). They also create and clearly outline the agent’s behaviors and their relationships. The experiments show that their proposed technique can detect slow-scanning and DDoS attacks, which validates their model. The authors planned to study combining cooperative computing with IDS to deal with real-world problems in future work.

Table 8. Advantages and disadvantages of signature-based detection approach.

Refs	Approach Used	Advantages	Disadvantages	Note
[106]	Naïve Bayesian Classifier	Simple and Easy to implement It does not require much training data It handles both continuous and discrete data Fast and applicable for real-time predictions	The assumption of independent predictor features is the fundamental drawback of Naive Bayes. Suppose a categorical variable in the test dataset has a category not present in the training dataset. In that case, the model will assign a probability of zero and not generate a prediction	It slow read attacks with 97.82% accuracy, and normal behavior was detected with 96.46% accuracy
[107]	CLASSIE and modulo marking methods are used to avoid spoofing attacks	It allows us to improve the detection and filtering of DDoS attacks while lowering the false-positive rate	Applicable at the source site	The packet marking overhead and the false-positive rate of DoS attacks are greatly reduced. Reconstruct and Drop method is used to make decisions and drop the packets on the victim side
[109]	Implementation of the Suricata IDS based on virtualization	Helpful in detecting network intrusion in a virtual network and detecting intrusion from encrypted traffic. Helpful in the detection of insider attacks and known attacks	If an attack occurs within a virtual network inside the hypervisor, it is not useful	The architecture includes the implementation of the Suricata IDS for securing virtualized servers on CC and the validation of the IDS in detecting DDoS attacks against virtualized environments and effectively protecting the CC from vulnerabilities
[110]	E-CARGO model	Efficient, fast, and secure	Decrease memory space and time	A multi-threaded Network IDS (NIDS) and Host-based IDS (HIDS) are presented in collaboration to provide an efficient, quick, and secure HIDS

and

Table 9. Detection approaches based on signature.

Refs	Detecting OSI Layer	Feature Selection Tool	Features Used	Dataset Used	Parallel Processing	Algorithm Used
[106]	L7	Unknown	Src bytes, Srv error rate, Diff srv rate, Terror rate, Srv diff host rate, Dst bytes, Service, Protocol type, Duration, Flag, Terror rate, Srv error rate, Same srv rate, Count, Srv count	New testbed containing: DARPA, KDD Cup and create new for testing	✗	Naive Bayesian classifier
[107]	L7	Unknown	Packets, physical address, incoming messages	Unknown	✗	Decision tree classification system called CLASSIE
[108]	L7	Unknown	the system shutdown initiation, logging off the user, disabling of connections, and the process of halting the system	Unknown	✗	Unknown
[109]	L3,4,7	Unknown	Packet header, IP	Unknown	✗	Unknown
[110]	L7	Unknown	Version, URI, and Request method, followed by a MIME-like message containing request modifiers, possible body content and client information	Unknown	✗	Unknown

summarize the existing DDoS detection approaches on CC using signature-based detection techniques.

5.3.2. Anomaly-Based Detection

Anomaly-based detection is based on a profiling program that will be created for the normal behavior of the network, which the anomaly-based detection system will use as a baseline. Deviation from this baseline will be treated as an anomaly or a possible intrusion [112]. Anomaly-based detection approaches can trigger multiple false alarms due to the changing nature of network behavior or zombies and suspicious requests on the application layer if the detecting algorithm parameters are not properly tuned. Without any tuning to optimization, the classifier will not increase the detecting accuracy. If not, collecting the correct logs in a good way to choose the features well will not contribute to the best detection. The input to detection could be in the form of a vector, object, point, or observation named as single data instances [113] or a combination of data instances. Several anomaly-based approaches are using DL and ML to detect HTTP flooding DDoS attacks.

Alqahtani and Gamble [114] came up with a DDoS attack detection technique for the CC service and developed a four-layer algorithm to resolve the originating service for the attack. The levels are so structured that each level is suitable for detecting the attacks’ symptoms using local data. Their detection techniques achieved O(n2) time in the worst-case scenario. They also reported a link between DDoS attacks and unauthorized messages passed across services.

Abusitta et al. [115] proposed a correlation mechanism by employing hypervisors to determine the predicted resource load of current compromised VMs based on specified metrics. The calculated resource load is then compared to the total resource load. The proposed approach collects system metrics to train the SVM classifier to distinguish between normal and malicious (i.e., DoS attack) VM activities. The results show that when utilizing the model to make resource adjustments, the detection accuracy hits 97.60%. Their findings also demonstrate that the accuracy of the revoking and granting adjustments was reduced by just 1.79 percent and 1.43 percent, respectively, under the effect of resource adjustments, which have minimal impact and may be ignored.

Choi et al. [116] proposed a way to detect HTTP-GET flood DDoS attacks using MapReduce. This method ensures the target system’s availability for precise and reliable detection of HTTP-GET flood attacks. The experimental results show that the proposed approach outperforms Snort detection because its processing time decreases as congestion increases.

Chen et al. [117] proposed a CC-based network monitoring and threat detection mechanism comprising monitoring agents, CC infrastructure, and operation center components. The proposed mechanism used Hadoop, Spark, and MapReduce to speed up data processing using separation and concurrent processing of data streams. Furthermore, they conducted a real-world experiment to evaluate the effectiveness of the developed network monitoring and threat detection and system performance to limit the risk of DoS attacks. The evaluation results reveal that the mechanism successfully detects and mitigates these attacks. Furthermore, the defensive system detects all published vulnerabilities and can identify unknown attacks [118].

Xiao et al. [119] proposed a protocol-free detection (PFD) algorithm to detect ransom denial of service (RDoS) attacks against the CC regardless of the protocol utilized in the attack. PFD calculates the flow correlation coefficient (FCC) between flow pairs and issues a warning once suspicious flows have been identified. The simulation result indicates it is effective in detecting RDoS attacks and can help detect and isolate adversary flows.

Dhanapal and Nithyanadam [55] used the OpenStack CC platform to implement their solution that detects, mitigates, and prevents low-rate HTTP DDoS attacks in the CC environment. The experiments yielded accurate findings in identifying attacks in the early phases.

The authors in [120] studied the existing DDoS attack detection frameworks and their flaws, then proposed a CC testbed framework on top of an OpenStack platform [121] for testing HTTP flood DDoS attack solution. They also looked into numerous attack paths to the web server on the CC, internally and externally.

The authors present a novel approach to protecting mobile-based systems from DDoS attacks. The model is built on anomaly detection to defend the public/private CC against zero-day attacks. By preventing CC DDoS attacks, the availability of CC applications significantly improved, and users will receive high-quality services [122,123]. Evaluations of the proposed model’s efficiency and performance were promising in safeguarding mobile-based CC systems against DDoS attacks. The focus is on detecting and protecting mobile-based systems from DDoS attacks [124]. [125] reported the approach’s complexity analysis, efficacy, and performance assessments, and the improved version is documented in [124].

Hazavehi and Rahmani [33] proposed and developed a mechanism called TPANGND for detecting DDoS attacks based on anomalies. Their mechanism uses flow-based classifier (FBC) to group similar input patterns into several clusters to determine an attack. Unique scenarios exist where FBC cannot distinguish between benign and malicious traffic. The suspect traffic is recognized in this situation by looking at the correlation between the VM instance issued by the CSP at a specific timestamp and the suspicious source list. The experimental results show that the suggested technique has a higher detection rate than existing K-means, fuzzy c-means clustering, bat clustering, and Bartd methods. It can detect unknown threats with fewer false alarms [126,127].

Abbasi et al. [128] proposed a new framework to detect various EDoS attacks by creating a profile that learns from and categorizes normal and abnormal activities. The more demanding resources are only allocated to VMs with a normal state in this framework, preventing the propagation of attacks and resource misuse in the CC.

Singh et al. [129] proposed collaborative IDS (CIDS), a system that combines cascading decision trees (DTs) and SVM to increase detection accuracy. DT speeds up the learning process and divides the dataset into smaller subsets; SVM on each sub-dataset (e.g., KDD99, NSL KDD, and ITOC) reduces SVM learning time, overcomes over-fitting, and reduces the size of the DT, allowing faster detection.

Raja Sree and Mary Saira Bhanu [127] proposed a method that scans log files to extract essential information related to HTTP flooding threats by grouping similar input patterns using fuzzy bat clustering and determining unusual behavior using deviating anomaly scores. They compared the findings with existing methodologies such as k-means clustering, fuzzy c-means clustering, bat clustering, and the Bartd method, showing the proposed method accurately diagnoses anomalies with low false alarms.

Table 10. Anomaly-based Detection approaches.

Refs	OSI Layer	Feature Selection Tool	Features Used	Dataset Used	Parallel Processing	Algorithm Used
[114]	L7	Unknown	End-time, start-time, status, request-response pair, SessionID	Random dataset (unknown)	✗	NA
[115]	L7	Unknown	Uses the same features as [130,131] source IPs, packet size, No. of sources, packet rate, Linux kernel features, Number of requests. HTTP-GET requests. Packets containing 200, 206, and 400 HTTP status codes, Linux kernel features, network bandwidth, system memory, and CPU time.	CAIDA “DDoS Attack 2007”, 1998 FIFA World Cup	✗	SVM classifier
[116]	L7	Unknown	Load, protocol distribution for the classification distribution of the network service, information distribution of the packet header, packet size, the maximum value, flow monitoring utilizing a spoofing address, Request URL, IP address of the remote host, CPU usage, minimum value of traffic, The time of the request	Unknown	✓	MapReduce
[117]	L7	Unknown	Packet length, source and destination ports, source and destination IP addresses, and packet timestamp	real-world network traffic data from Chicago Equinix DC	✓	MapReduce, Spark, k-mean clustering
[118]	L7	Unknown	Unknown	Unknown	✗	NA
[119]	L7	Unknown	Unknown	Unknown	✗	PFD
[132]	L7	Unknown	Time, source IP, destination IP, protocol, length.	Generated a new prediction-based data set	✗	naıve Bayes
[55]	L7	Unknown	TCP Window size, the time interval between requests, size of data, response time, URL, number of connections per second, length in seconds	Unknown	✗	NA
[120]	L7	Unknown	IP address, multiple HTTP requests, time interval	FIFA World Cup 1998 real-time	✗	NA
[123]	L7	Unknown	Memory usage, CPU usage, Latency, Packet loss, Throughput and Link utilization, time, duration, pro- tool and rate	Unknown	✗	NA
[124]	L7	Unknown	Source and destination IP addresses	Unknown	✗	correlation algorithm
[125]	L7	Mahalanobis distance (MD)	Source and destination IP addresses, No. of packets, time intervals	Unknown	✗	graph path traversal
[127]	L7	Grouping of similar input patterns using fuzzy bat clustering	Remote host, request strings similarity, GRPS, VM status, inter-arrival time between requests, periodic repeatability and port number, request time, group consists of user ID, VM ID, and time stamp of the VM instance	Unknown	✗	grouping of similar input patterns using fuzzy bat clustering
[33]	L7	Unknown	RT, Svc, Calc, CPU, a mixture of CC resources, Request, Req, Calculate, and Rspns are the Service abbreviations, Response time, memory, bandwidth, and Response	Unknown	✗	TPANGND
[128]	L7	Unknown	TSP, IOWo, IODi, IODo, CPUW, CPUD, MemW, R(SYN), NBWph, IOWi, NBWpd, NBWpw, NBWpm, R(ACK), NPi R(SYN+ACK), NPo, NHOP	Unknown	✗	SVM and neural network

and

Table 11. Advantages and disadvantages of anomaly-based detection approach.

Refs	Approach Used	Advantages	Disadvantages	Note
[114]	DDoS attacks Prevention approach for flooding	Reduce resource consumption and delay	Identified the sudden surge in incoming requests to a target, thereby rendering it overloaded and congesting the communication channel leading to it	A distributed detection of flooding-based DDoS attacks is presented and has also identified the attacking services within a service CC
[115]	SVM Learning-based flexible detection framework for DDoS attacks technique	This approach can enhance the detection accuracy under changing environments It helps the hypervisor identifies compromised VMs that may try to claim and consume more resources	No major drawbacks	There is a future scope to enhance the attack detection approach.
[116]	Snort detection based on HTTP	Lower processing time than regular Snort. More accurate and reliable detection mechanism	Increase congestion	There is a need to study the various pattern recognition approaches for detecting DDoS attacks in a CC context
[117]	A CC-based network monitoring and threat detection system	Monitors network activities efficiently. Detects abnormal behavior and network threat	High overhead	There is a plan to enhance the attack detection accuracy in the future
[118]	XML and HTTP application layer attacks prevention mechanism	Intelligent, fast, and adaptive. Can detect spoofing and regular flood attacks	High overhead, low efficiency	There is a future scope to enhance the attack detection approach
[119]	Flow correlation coefficient (FCC)-based protocol-free detection (PFD) algorithm	It detects attacking flows efficiently and effectively. Protocol agnostic	Low efficiency	It is an effective approach for detecting RDoS attacks
[132]	ML-based algorithm, Naïve Bayes, and Random forest	Naïve Bayes is stronger than random forest. Naïve Bayes detects the attack more efficiently than random forest	High overhead	There is a future scope to enhance the attack detection approach
[55]	OpenStack, slowHTTPTest open-source tool	High accuracy in attack detection in the early stage	High overhead, low efficiency	There is a future scope to enhance the attack detection approach
[120]	HTTP flood DDoS attacks	It uses the OpenStack Platform and real-time datasets for performance evaluation	HTTP Errors, Higher Response time	The suggested framework will be improved in the future to identify and mitigate HTTP flood attacks in the CC
[123]	Anomaly Detection	Reduce resource consumption	Low Detection Rate and Detection Time
[124]	Architecture for mobile CC security	Accuracy, sensitivity, and specificity rates	No major drawbacks	The proposed approach has a performance average of (97.03%), with an average accuracy (98.05%), average sensitivity (93.34%), and average specificity (93.34%)
[125]	Correlation analysis model	High accuracy	High overhead	NA
[127]	Fuzzy bat clustering	Determines anomalies accurately with very few false alarms. High detection rate	Misidentified benign or malicious traffic in a few cases	Hybrid optimization strategies may be applied in the future to improve detection efficiency
[33]	Anomaly-based framework	High DDoS attack detection	High overhead
[128]	Execution Trace Analysis	High accuracy in attack detection	Low efficiency	There is a future scope to enhance the attack detection approach

list some existing CC DDoS detection approach based on anomaly detection techniques.

5.3.3. Hybrid Detection

A hybrid detection approach combines multiple detection approaches, including signature- and anomaly-based approaches. However, it has some drawbacks, such as a conflict between the two approaches, resulting in increased detection time. Therefore, the hybrid approach requires balancing options and complimentary features for each approach to improve discovery and detection rates.

Several researchers have adopted this approach and have presented architecture and methods for performing intrusion detection utilizing hypervisor performance metrics using virtualization technology based on CC. Furthermore, it is demonstrated that suspicious activities can be profiled without detailed knowledge of the OS running within the VMs using VM performance metrics gathered from hypervisors, such as packets transmitted/received, block device read/write requests, and CPU utilization [133].

Patil et al. [134] have designed an efficient security framework called Protocol Specific Multi-threaded Network IDS to detect DDoS attacks in a CC. It works by separating the incoming packets based on the protocol. These packets are sent in a queue for processing therein. The framework thread is responsible for handling each queue which also extracts the relevant features and applies protocol-specific classifiers for each packet in the queue. They used the KDD’99 dataset.

SaiSindhuTheja and Shyam [135] proposed an efficient DoS attack detection system based on the oppositional crow search algorithm (OCSA), which combines the crow search algorithm (CSA) and the opposition-based learning (OBL) technique. The proposed method has two stages: feature selection with OCSA and classification with an RNN classifier. The OCSA method identifies the key features, then feeds into the RNN classifier. The RNN classifier is used to classify incoming data during the testing process. It ensures that standard data (saved in the CC) is isolated from compromised data. The results show that this strategy outperforms other conventional methods by 98.18%, 95.13%, 93.56%, and 94.12% in terms of Precision, Recall, F-Measure, and Accuracy, respectively, using the benchmark data set. In addition, the suggested approach surpasses existing efforts by 3% on average across all metrics.

Many existing ML algorithms, such as neural classifiers, can detect DDoS attacks. The researchers in [136] discussed the findings of a survey on DDoS attacks in the CC environment. DDoS attacks are frequently categorized as bandwidth and resource consumption attacks. SYN Flood and Flash Crowd are prevalent DDoS attacks in a CC context. Nagaraja et al. [136] also tested many ML algorithms to detect DDoS attacks; some are more accurate than others. The use of ML techniques resulted in a higher false-positive detection rate. According to their study, after examining several studies on network attack detection in the CC environment, the most extensively utilized technique to detect DDoS attacks in the CC is ANN, SVM, KNN, J48, feature rank, and feature selection.

Table 12. Hybrid-based DDoS detection approaches on CC.

Refs	Detecting OSI Layer	Feature Selection Tool	Features Used	Dataset Used	Parallel Processing	Algorithm Used
[133]	L3,7	Unknown	Block Device Write Request (Block Device Write Req), Block Device Read Requests (Block Device Read Req), Packets Transmitted (Packets TX), Packets Received (Packets RX), and CPU Utilization (CPU Util)	Unknown	✗	NA
[111]	L3,4,7	Unknown	IP, MAC address, port, data content, Size, Protocol, Time, TTL	Unknown	✗	E-CARGO, Advanced Research Projects Agency (DARPA), Common Intrusion Detection Frame (CIDF)
[134]	L3,4,7	Unknown	protocol, port numbers, traffic, HTTP, telnet, flag, source bytes, destination bytes	KDD’99	✗	ID3 decision tree, Random Forest, OneR
[129]	L3,7	Unknown	Failed login attempts number, flag, src byte, DST byte, land, root access number, protocol, service, ag error, TCP/IP connection. Duration, protocol type, service used, urgent, num failed logins, logged in, root shell, num root, count, syn error rate, rejection error rate	KDD99	✗	Decision Tree, SVM

and

Table 13. Advantages and disadvantages of hybrid-based DDoS detection approach.

Refs	Approach Used	Advantages	Disadvantages	Note
[133]	Hypervisor-based cloud IDS	Can profile suspicious activities without knowing the OS running within the VM Does not require additional software installed in VM	High overhead, Low efficiency	There is a future scope to enhance the attack detection approach
[111]	Collaborative intrusion detection architecture	It can detect slow scanning and DDoS attacks	Low efficiency	There is a future avenue to enhance the attack detection approach
[134]	Protocol specific multi-threaded network IDS	Can detect known and unknown attacks in the CC It has a high detection rate It has low false negatives	Unable to detect other attacks	In the future, this system can be extended to detect other types of attacks
[129]	Collaborative IDS (CIDS) Framework, Snort with signature matching	Improved detection accuracy and system performance The learning process has become faster	No major drawbacks	There is a future scope to enhance the attack detection approach

list some existing DDoS detection approaches on CC using hybrid detection techniques.

5.3.4. Entropy-Based Detection

Entropy is the ratio of arbitrariness in the data. Entropy-based detection approach analyzes random data, the entropy, or the Shannon-Wiener index to evaluate uncertainty associated with the data. Maximum randomness in the data implies a maximum entropy value [137,138]. For example, if the data only has one class, its entropy value will be lower. On the contrary, the data with numerous classes will have a higher entropy value. This way, the tested headers are broken down for port and IP, and their entropy is computed.

Entropy is usually used to calculate the randomness of IP source addresses or port numbers. A high entropy value indicates the traffic originates from various sources, which is the clue to detecting DDoS attacks [139]. A threshold can be put in place to distinguish DDoS attack traffic from normal traffic. The administrator should be alerted of DDoS attacks if the entropy value exceeds the threshold. If the detection of DDoS attacks involves multiple levels, the procedure can be partitioned into three stages:

• First stage: The client is permitted to go through the switch, and the detection calculation confirms that it is genuine.
• Second stage: The entropy is calculated based on the data packet size and the client’s authentication.
• Third stage: The entropy value is compared with the threshold to determine if it is a DDoS attack or not.

Once the location of any abnormality is discovered, an information message is sent to CSP owners to take necessary action. The authors in [140] proposed an approach to detect HTTP flooding DDoS attacks in a CC using information-theoretic entropy (ITE) and ML to improve the false-positive rates. They are planning a real-world deployment of their approach for evaluation using several HTTP DDoS attack tools in the future.

The authors in [141] developed an entropy-based detection technique for DDoS attacks, achieving a 90 percent accuracy without extra packet overhead, resulting in excellent QoS. In addition, they have used CCs to implement the same algorithm. Meanwhile, the authors in [142] used a Gossip-based DDoS attacks detection apparatus for attack detection in a computer network by exchanging a stream of traffic-over-line.

The authors in [143] used an improved entropy to detect the cause of overload and locate the source of the problem, but [144] is similar in its approach to these authors. It appears that a reduction in traffic and improved response time could be feasible with the data simulated.

Girma et al. [145] examined and compared various DDoS attack detection techniques against multiple parameters. After discussing their benefits and drawbacks, they proposed a hybrid statistical model that could significantly mitigate DDoS attacks, providing a better solution to current detection issues. The authors of [83] looked at the standard EPA-HTTP (environmental protection agency-hypertext transfer protocol) dataset. They chose the input parameters for the classifier model to distinguish an attack from a regular profile.

Table 14. Entropy-based DDoS detection approaches.

Refs	OSI Layer	Feature Selection Tool	Features Used	Dataset Used	Parallel Processing	Algorithm Used
[140]	L7	Unknown	Source/destination ports, source/destination IP	CIDDS-001	✗	ITE ML, RFEL
[141]	L3, 7	Unknown	Traffic distribution like IP address, Port, number of packets	Unknown	✗	Attack Packet dropping
[145]	L3, 7	Unknown	The huge distance between the data and baseline entropy	Unknown	✗	NA
[83]	L7	Unknown	Entropy, HTTP-GET request count, and difference for every connection, IP address	EPA-HTTP	✗	MLP, GA, Artificial Neural Networks (ANN)
[146]	L3, 4, 6, 7	Unknown	IP address, port, flow size	Unknown	✗	Detection algorithm, Confirmation algorithm

and

Table 15. Advantages and disadvantages of entropy detecting.

Refs	Approach Used	Advantages	Disadvantages	Note
[140]	Information-Theoretic Entropy and Random Forest	high HTTP DDoS attacks detection performances	Not yet deployed in the real world	They planned to perform real-world deployment of this approach and evaluation w.r.t several HTTP DDoS attacks tools as a future scope
[141]	Attack Packet Dropping Algorithm	Easy to adapt, More trustworthy High accuracy, No extra packet overhead, Good QoS	Low efficiency	The proposed architecture and recommendation may be applied on a CC platform to accurately identify DDoS attacks. The concept can be expanded to include a recovery mechanism for DDoS attacks
[145]	Hybrid Statistical Model	It helps in attack mitigation	More overhead	The proposed scheme with two checkpoints will be a superior alternative solution in reducing risk and providing a better outcome
[83]	Artificial Neural Networks	High accuracy	Suitable only for application-layer DDoS attacks detection	This approach can be extended for developing an efficient detection for attacks
[146]	Entropy	The rate of entropy is lesser when the class distribution is pure	Security issues can be there as the third-party vendor handles them	This algorithm works in 2 phases. First, users are permitted to travel through the router on the network site. While in the second, the traffic passes through a cloud-based router that uses a confirmation algorithm and checks for a threshold value

list some existing DDoS detection approaches on CC using entropy-based detection techniques.

5.3.5. Filtering Tree-Based Detection

A technique proposed in [147] identifies flood attacks by analyzing network logs and keeping track of the connection states, such as the active IPs of incoming requests. It alters the window size (number of time slots) and measures the sliding window of dynamic entropy, which is dependent on traffic load. In a CC setting, traditional DDoS attacks on servers and network resources could morph into a new breed of attack called EDoS attacks, which target the CCC’s economic resources. The researchers have presented a unique mitigation strategy against EDoS threats, utilizing source checking, counting, and Turing Test. The simulation results suggest that their technology can mitigate CC EDoS attacks.

Researchers in [148] proposed a CC defender system named cloud service queuing defender (CSQD) to detect and remediate XML vulnerabilities in online services. CSQD, a self-learner, employs a traceback solution to determine the source of the attack. Suppose an attack successfully shuts down the server; the CSQD system will detect the malicious requests and store them in its database to prevent similar attacks in the future. The authors presented a game-theoretic model and study that predicted widespread strategy adoption, reducing the risk of DNS amplification attacks. They have demonstrated the ability to implement their concept as a CC-based service to cut costs further and provide additional defenses for DNS servers.

A new solution dubbed an enhanced DDoS-mitigation system (Enhanced DDoS-MS) has been developed to combat EDoS attacks by leveraging firewall capabilities to control a verification process to protect the targeted system. Researchers used a simulated environment to assess their proposed system, showing the firewall successfully mitigates DDoS attacks by increasing users’ services in response time and server load under attack [149,150].

Fontaine et al. [151] proposed a simplified CC security utilizing ML approaches to address the challenge of complex and platform-specific CC security architectures. It leads to a more general design that employs decision trees and neural networks as classifiers, trained using data gathered by CC apps. Iyengar et al. proposed a multilevel thrust filtration (MTF) mechanism as a solution against DDoS attacks in a CC environment. The mechanism authenticates incoming requests and detects various types of DDoS attacks at various levels at the early stage to prevent unnecessary traffic from reaching the DC [152].

Table 16. DDoS attack detection approaches based on filtering tree.

Refs	Detecting OSI Layer	Feature Selection Tool	Features Used	Dataset Used	Parallel Processing	Algorithm Used
[153]	L7	Unknown	IP, SOAP header, URI	Unknown	✗	Hop count filter
[154]	L7	Unknown	threshold logic unit (TLU), IP address, HTTP Request, IP header	Generate new real-time data	✗	DPM, neural network (NN)
[155]	L7	Unknown	IP, Session such as Session ID, Port, CPU Processing Time such as Average Processing Time for accessing the resource, Processing Time for request	KDD Cup 2000 data set (KDD Cup Competition, 2000)	✗	decision tree algorithm J48
[148]	L7	Unknown	IP, ID, date Time-consuming, URL, Request List, content, requested URL	Unknown	✗	CSQD
[156]	L7	Unknown	IP, cookie, Time to Live (TTL), number of requests	CIDR notation	✗	Filter, game-theoretic model
[150]	L7	Unknown	IP address, TTL value, HTTP requests, response time, average load level	Unknown	✗	graphical Turing Test (CAPTCHA)
[151]	L7	Unknown	Unknown	Collect access logs from multiple web applications	✗	J48 decision trees, neural networks
[152]	L3,7	Unknown	IP, ID client, ID request, password, session, type of incoming request, MAC address, request size, timestamp	Unknown	✗	MTF

and

Table 17. Advantages and disadvantages of filtering tree-based detection technique.

Refs	Approach Used	Advantages	Disadvantages	Note
[153]	Dynamic Entropy Method	It can detect HTTP flood attacks with a high probability Capable of reducing false alarms. Performance enhancement	More overhead, Low efficiency	Statistical analysis can be used in the future to ban harmful IPs and record questionable IPs
[154]	DDoS attacks and EDoSShield	it can detect the attack messages within a very short period	Low efficiency	The scope will be to set up CC Protector for real-time data collection and testing in the future
[155]	novel mitigation system against DDoS attacks	Efficient in mitigating the EDOS attack, reduces response time and computing power utilization	More overhead, Low efficiency	There is a future scope to enhance the attack detection module and integrate it with the proposed mitigation techniques
[148]	(Cloud Service Queuing Defender)	effective and efficient in detecting and mitigating most DoS attack Self-learner	More overhead, Low efficiency	the CSQD system detects the malicious request and stores it in its database to prevent similar attacks in the future
[156]	Game-theoretic model and analysis	It is very beneficial for a range of Internet clients and services	It generates a list of ’good’ DNS resolvers and platforms and a list of potentially hacked (suspicious) hosts	The model has its own merits and can be used to assess defenses against various sorts of DoS attacks
[150]	Traditional network security	Better response time and server load	It is dependent on firewall security	In the future, more complicated scenarios of the Enhanced DDoS-MS framework will be implemented in the same simulation environment
[151]	Log-Based Intrusion Detection, ML techniques	It is simple while training for the detection models and has high accuracy in attack detection. Very fast method	More overhead	Web CC security logs identical to traditional on-premise security logs are presented as contributions
[152]	Multilevel Thrust Filtration (MTF) mechanism	It can be deployed at an attack-prone DC for resource protection	Low efficiency	A hybrid approach to detecting 4 types of attacks simultaneously

list some of the existing DDoS attack detection approaches on CC based on the filtering tree technique.

6. Requirements of DDoS Attacks Detection Approaches on CC

Certain requirements must be considered when proposing new DDoS attack detection approaches on CC. The core requirements are listed below:

• Efficient: The approach should be efficient enough to do its function, which implies reducing the DDoS attack’s effect regardless of how destructive the DDoS attack is. The request-response time is related to the average time for a successful HTTP response from the VM. With the increase in DDoS attacks average, processing capability impacts the request-response.
• Accurate: The approach should not provide multiple false positives. Several approaches require the traffic to be discarded or dropped, and the approach should not drop the original traffic.
• Lightweight: The approach should not burden the system to protect against DDoS attacks, not affecting the performance.
• Easy: The approach is not difficult to implement and easy to understand, i.e., does not require major changes on the existing CC to work, such as configuration, infrastructure design, or devices.
• Functional: The approach must be practical enough, which means it can reduce the impact of DDoS attacks regardless of the magnitude.

7. Critical Discussion

This section discusses the taxonomy of detection approaches based on signature (Table 9), anomaly (Table 10), hybrid (Table 12), entropy (Table 14), and filtering tree (Table 16).

Table 9 shows that [109] is better than others in detecting CC DDoS attacks due to its comprehensiveness in detecting attacks at multiple OSI model layers (network, transport, and application) as opposed to only at the application layer. Moreover, as shown in Table 8, Khatri and Khilari (2015) also has a high detection rate of intrusion from encrypted traffic, helpful in the detection of insider and known attacks, while others work not [109]. Table 10 and Table 11 show that [115], an SVM learning-based flexible detection framework for DDoS attack techniques, is better than the existing techniques and in accurate detection of DDoS attacks under changing environments. Further, it helps hypervisors identify compromised VMs that may try to claim and consume more resources. Most importantly, this approach does not have any major limitations.

Table 12 and Table 13 show that [111] is suitable for detecting only slow scanning attacks. In contrast, the technique of [134] is slightly superior to others in detecting known and unknown attacks in the CC, with high detection rates and low false negatives.

Table 14 shows that the entropy technique used by [146], i.e., the detection algorithm and confirmation algorithm, has the best attack detection at all OSI layers compared to others. Table 15 shows that the entropy rate is lesser when the class distribution is pure in [146] with a minor drawback that the third party handles it, so there might be a few minor security concerns. Alternatively, the technique by [144] performs well with a 99.3% accuracy rate.

Table 16 and Table 17 show that the multilevel thrust filtration (MTF) mechanism in [152] can detect attacks occurring at OSI layer 3 and 7, which are undetectable by others. Furthermore, Table 17 shows that the technique in [152] can be deployed at an attack-prone DC for resource protection and can simultaneously detect four types of attacks.

8. Conclusions and Future Work

This research attempts to break through the obscurity and build the body of knowledge related to CC security. The security issues of CC discussed include service misuse, insider attacks, insecure and unreliable applications, data corruption or leak, and shared technology vulnerabilities. Meanwhile, the challenges of CC discussed cover the technological, technical, and security aspects.

This research reviewed the latest trends in optimal DDoS attack detection techniques from 2013 to 2021 and has also brought up some crucial aspects of multiple-layer attacks. This research proposed a new taxonomy of attacks, DDoS attacks, and DDoS attack detection approaches on CC. More precisely, we discussed various attacks on CC, such as suffocating, protocol, economic, and permanent economic attacks. Also covered are DDoS attacks on CC utilizing SYN floods, UDP floods, ping of death, ICMP floods, and HTTP floods. We discussed the different approaches of DDoS attack detection methods based on the signature, anomaly, hybrid, entropy, and filtering tree. In addition, we also discuss the various factors, such as efficiency, accuracy, and lightweight, that must be considered when choosing an effective DDoS attack detection strategy.

Our observation of the proposed taxonomies reveals that anomaly-based detection approaches produced the best result due to their ability to identify anomalous events, allowing the creation of rules to reduce the false alarm rate for known and unknown attacks. However, further research on anomaly-based approaches using ML and DL is worth pursuing as they are not yet widely employed to detect HTTP-GET flood attacks on CC. Furthermore, the proposed taxonomy can serve as a roadmap for new researchers to easily explore the existing DDoS attack detection techniques on CC.

Finally, it is worth mentioning that the proposed taxonomy has to be regularly updated to include emerging attacks.