# Comparative Study of AI-Enabled DDoS Detection Technologies in SDN
## 3 Model Overview and Methodology
### Experimental Environment  
Our DDoS detection model is based on an SDN-based topology that is built on Mininet to simulate the results of the experiments, as shown in Figure 3. Our system topology consists of six PCs, one OpenFlow switch and an RYU SDN controller. Among the six PCs, two are attacker PCs, while the other four PCs generate normal traffic. To detect the attacker traffic, we use the RF, NB, DT, CNN and RNN classifiers on the controller for the testing and training of the traffic. Deep learning is essentially derived from machine learning and researchers have found that machine learning performs better in DDoS attack scenarios.  
Mininet is a network emulator that provides the functionality to create a virtual network environment with the ability to communicate with virtual devices using virtual links [35]. It also provides capabilities to integrate different SDN controllers, such as RYU SDN controllers based on Python. Mininet provides some great advantages that make it an ideal choice: it supports the OpenFlow protocol and is capable of running Linux applications in a virtual environment. The RYU controller is an open-source component-based SDN framework and provides software components with a well-defined API, which makes it easy for developers to create new network management and control applications [36].  
\begin{table}
\begin{tabular}{l l l l} \hline \hline
**\#** & **Feature** & **Importance** & **Description** \\ \hline
1 & fl\_iat\_avg & 0.5334 & Two flows average time \\
2 & fw\_iat\_max & 0.3351 & Maximum time of two packets sent \\
3 & fw\_win\_byt & 0.3248 & Number of bytes \\
4 & fw\_iat\_tot & 0.3231 & Total time of two packets sent \\
5 & fl\_dur & 0.3162 & Time of duration \\
6 & fl\_iat\_min & 0.2778 & Minimum time of two flows \\
7 & bw\_iat\_min & 0.2655 & Minimum time of two packets sent \\
8 & fl\_iat\_max & 0.2426 & Maximum time of two flows \\
9 & fw\_iat\_avg & 0.2203 & Mean time of two packets sent \\
10 & bw\_pk\_t\_l\_max & 0.2139 & Maximum size of packet \\
11 & bw\_iat\_max & 0.2077 & Maximum time of two packets sent \\
12 & bw\_win\_byt & 0.1944 & Number of bytes sent \\
13 & bw\_iat\_tot & 0.1942 & Total time of two packets sent \\
14 & fw\_iat\_min & 0.1520 & Minimum time of two packets sent \\
15 & bw\_iat\_avg & 0.1513 & Mean time of two packets sent \\
16 & idl\_max & 0.1139 & Flow maximum time before becoming active \\
17 & bw\_seg\_avg & 0.0926 & Average size observed \\
18 & Bw\_pkt\_l\_avg & 0.0922 & Packet average size \\
19 & fw\_pkt\_l\_avg & 0.0913 & Packet average size \\
20 & pkt\_size\_avg & 0.0910 & Packet average size \\ \hline \hline \end{tabular}
\end{table}
Table 2: The top 20 features selected using permutation importance algorithm.  
Figure 3: An SDN topology on Mininet for DDoS attack testing.  
RYU supports different versions of OpenFlow protocols, and it supports the NETCONF and OF-config protocols [37]. RYU uses scripts and the OpenFlow protocol to communicate and manage the switches [38]. The experiments are carried out on a Ubuntu (18.10) virtual machine setup on VMware with 2 GB of RAM and 200 GB hard drive space and Mininet (ver2.3) is used with an RYU (ver4.3) controller. The SDN network contains the following units: an RYU controller, an OpenFlow switch and 6 PCs, in which one is an attacker PC, another one is a victim PC and all other PCs are normal PCs, as shown in Figure 3. In the experimental first stage, the classifiers are trained and tested using all features in the dataset. In the second stage, the permutation importance algorithm is used to select the most effective features in the entire dataset. The performance ratio is determined with the RF, NB, DT, CNN and RNN algorithms on the basis of the selected features.