Because of the great impact of DoS attacks, there is a substantial literature on the subject.

Tolanur et al. developed an analysis model based on Weighted Logistic Regression (WLR) and one on Random Forest(RF) demonstrating their power as tools for detecting and analysing DoS attacks. Logistic Regression is a statistical method used for binary classification problems, able to predict the probability of an event occurring by fitting data into a logistic curve. WRL is an extension of logistic regression that assigns weights to different instances in the dataset, in relation to their importance or relevance. Random forest, instead, is build on multiple decision tree build with multiple subsets of the training data. Both the algorithms resulted very effective and powerful, WLR in a particular way for its capacity of due to imbalanced datasets and its interpretability, while the Random Forest for its accuracy and robustness \cite{Tolanur2023}. Differently from Tolanur's work, it has been opted to a different AI algorithm, Multi-Layer Perceptron, based on deep neural network. This algorithm is capable to deal with structured data and automatically learn relevant features from the input data, reducing the human labour. Furthermore, thanks to its non-linear activation function, it is able to model non-linear relationships in data. The Random Forest similarly to Tolanur has been used as baseline, to compare the results of the MLP.

Yihunie et al. evaluating the effects of the Ping of Death (PoD) compare the performance of the attacks on a healthy network, performed by a standalone machine and multiple attacking machines using Riverbed Modeller Academic. The simulation was configured to run for 5 hours capturing performance like DB Query Response Time, Traffic Received, Traffic Sent, Upload and Download Response Times. The study demonstrates the severe impact of DDoS attacks on the performance of internet-based services and offers advices about the possible metrics to consider in order to spot a DoS attack \cite{Yihunie2018}. Similarly, in this work it has been captured the server performance keeping trace of the traffic received and the traffic sent, but instead of concentrating on the performance of specific DB query, it was concentrated on the performance of generic TCP connection. In addition, it has been observed the number of opened and closed connection, together with their duration.

Arnes et al. created ViSe, a virtual security testbed, which are environment designed to study computer attacks and suspect tools within the context of digital forensics, with the aim to support or refute hypotheses about security incidents through controlled experiments that emulate digital crime scenes. It can be physical, by cloning the entire environment, completed of hardware and software, virtual when is emulated on a single host and finally, simulated on testbeds, which instead, use mathematical models and algorithms to recreate the behaviour of networks, systems and cyber-attacks. The paper demonstrate that the ViSe enhances the credibility of the forensic investigations \cite{Arnes2007}. The work of Arnes has been inspiring for the elaboration of the secondary aim of this project. In fact, it led to the expansion of the environment from just two virtual machines to an entire virtual network, allowing the elaboration of several experiments and exploration of design alternatives, like the use of Fluentd as log collector and manager of the prediction data. 


Fadzil et al. proposes a testbed using Raspberry Pi devices to simulate smart meters and VMs to simulate data collectors and servers. The testbed uses tools like BoNeSi for generating attack traffic and Whireshark for monitoring and analysis. The aim of the project is to evaluate the impact of DDoS attacks on IoT environments and develop an effective detection mechanism. To test the system, ICMP flood, TCP SYN flood and HTTP flood attacks have been performed. The metric to analyse the performance are relative to the CPU usage, memory usage, ping response and the smart meter throughput \cite{Fadzil2022}. Similarly to Fadzil's project, in this thesis, SYN flood gets treated, but marginally. In addition, a hardly detectable by human eye attack (slowHTTP) and another Application Layer attack (HTTP flood) are performed. Using an AI, in fact, allows an easier and automatic detection of highly hideable attacks, especially in relation to human conducted analysis with the use of Wireshark. 


%Alcarria et al. with professor Bordel realised an AI model to detect a DoS attack. The realisation of the dataset has been conducted by collecting data by means of eBPF during benign traffic and malicious traffic. The data has been collected in chunks of 0.5 seconds, based on eBPF tools tcpLife and tcpTrace. The model has been realised based on MLP algorithm. The testing, in the same way as the data collection, happened on two virtual machines, an attacker and a server. If the model detects an attack, it signals it in an alarm-server. The work of Bordel and Alcarria, also thanks to their close collaboration, has been chosen as reference point of the project.

Zulkifli et al. focused their work on analysing DoS attacks on Routerboards using live forensics methods. The research uses Wireshark to detect and analyse network traffic during DoS attacks, aiming to collect digital evidence while the system is operational.
Live Forensics is essential for capturing volatile data that might be lost if the system is turned off, and allow the collection of digital evidence in real-time. The experiment involved the simulation of DNS flooding attack, with the software DNS Flood Master and its analysis using Wireshark. To acquire the forensic data at first it's required to check if the system is operational (the opposite would lead to the loss of important data), to connect the network with an investigator node to monitor and analyse data traffic in real-time. Moreover, thanks to admin login, detailed logs and configuration of the Router are withdrawn in a Log Activity and an IP Address List to identify the attacker. Finally, data are analysed by means of Wireshark and a report is compiled \cite{Zulkifli2018}. The work of Zulkifli highlighted the importance of the digital forensic science and suggested the importance of the collection of the log activity of the nodes and the collection of the data in permanent way. For this aim, it has been used syslog-ng as log system and Fluentd for the collection of the logs and data. In similar way to Zulkifli project, logs and data have been collected in an administration node.


Zafarullah et al. covered the topic of the digital forensics for cloud computing environments. The challenges are relative with the location and accessibility of the logs, that may not be available locally and that may be distributed on different machines and data centres, making it hard to highlight of relevant data. The paper focus on using logs from Eucalyptus, an open-source cloud computing framework, to identify Syslog, Snort or other log entries that can detect a cloud attack. The struggles are relative to the location transparency, which makes harder the localisation of data but also the understanding of the event dependencies. The paper highlights the importance of the relation between logs and their location \cite{Zarafullah2011}. In similar way in this project it has been treated the problem of the logs and their source. To solve the problem it has been used syslog-ng as logger and Fluentd, installed on the administrator node, as log collector. Each log collected takes notes of the source IP address, as well as the origin of the log.

Achi et al. examines a case of study tracing a DoS attack and outlines the methodologies of digital forensics, identifying the network vulnerabilities and security measures to prevent intrusions. Achi identifies vulnerability of network topologies Ring and Bus in the transmission of data, that is accessible to all nodes between the source and destination, making it vulnerable to interceptions. He also underlines protocol deficiencies, like the ARP table poisoning, to redirect network traffic into the attacker's machine or the Loki Attack, in which the Loki software is used to set up backdoors on compromised systems. Next, the attacker sends commands inside ICMP packets that the router assumes as harmless. Another network vulnerability is associated to routers and consist in a port flooding. The solution offered are mainly focused on firewall alternatives, offering a sight on the types of firewalling existent. He also offers some trace back proposals to identify the attacker. Finally, a DoS case is studied and solved by sniffing the packet with tools like tcpDump, that belongs to the same library as tcpLife and tcpTracer \cite{Achi2008}. 

Sachdeva et al. explores the application of machine learning in digital forensics to detect DoS attacks within cloud networks, with specific attention on ICMP assault, TCP SYNC attack and UDP attack. The methodology uses Multi-Layer Perceptron combined with digital forensics techniques aiming in the reducing of false positives and improve detection rates. The digital forensic process consisted of a collection, an examination, a partial analysis, reporting and feedback. As dataset, Sachdeva used NSLKDD-Dataset, an updated version of the KDD Cup 1999 dataset, cleaned of the redundant or duplicate records \cite{Sachdeva2022}. Differently from Sachdeva, in this project has been opted for a dataset from a previous work, elaborated from a newer dataset recorded by the Canadian Institute for Cybersecurity (CIC-IDS2017). This dataset, contains HTTP flood attacks and slowHTTP attacks, which are the one, mainly, analysed in the forensic process. Similarly, an MLP algorithm has been used to recognise the DoS attacks.

