## 5 Material and Methods
### Attack Detection Module  
The SD-VANET_Guard security system we have developed incorporates a hybrid artificial intelligence model named 1 DCNN-DT, designed to detect DDoS attacks. The 1 DCNN-DT model is a hybrid artificial intelligence model consisting of the combination of a one-dimensional convolutional neural network and decision tree algorithms. The model extracts deep features through 1 DCNN layers to detect attack patterns in network traffic. It then passes these features to the Decision Tree algorithm to classify them as attacks or normal traffic. While 1 DCNN captures the fine details that stand out in low-volume DDoS attack traffic, the Decision Tree provides real-time threat detection by quickly classifying these features. This structure balances accuracy and processing speed, providing an effective security solution in dynamic network environments such as SD-VANET. In this study, the collection of network traffic data is performed through the Ryu controller. SD-VANET_Guard collects all flow table entries from each switch in the experimental topology via the OpenFlow protocol. These entries are transmitted from the data plane to the control plane of the network. The developed data collection module processes each flow table entry and extracts specific attributes. These attributes are derived from network traffic characteristics, such as packet count, data size, source and destination IP addresses, and protocol type. Feature extraction is performed based on predefined criteria to analyze the behavior of the flow over time. The extracted features are transmitted, in JSON format or other standard data transmission formats, to the hybrid AI model (1 DCNN-DT) that has been pre-trained to classify the flow as either legal or illegal. This process involves feeding the data into the input layer of the hybrid AI model in the controller, with the data being transmitted over the TCP/IP protocol or directly via the network's transmission channels with minimal latency. The hybrid AI model processes these inputs and determines whether the flow is legal or illegal. Upon detecting illegal network traffic, the system generates an immediate alert. This alert is relayed by the controller to the router or other network components. The alert generation typically takes place through an alert module within the controller, and these alerts are communicated to network administrators and relevant security units via protocols such as SNMP (Simple Network Management Protocol) or syslog. Additionally, the alert can be programmed to trigger actions, such as limiting or blocking traffic from the source of the attack. Following the data collection process, the 1 DCNN-DT hybrid artificial intelligence model was employed for processing the data and classifying the network traffic. To detect DDoS attacks, a dataset was first created for use in the training and testing phases of the hybrid AI model. In the prepared dataset, samples of illegal network traffic and legal network traffic were labeled as '0' and '1', respectively, representing the two classes. Subsequently, the training and testing of the hybrid AI model were conducted. After completing the training and performance testing, the model was made ready for deployment. The SD-VANET_Guard security system was then integrated as part of the controller. This systematic structure is capable of distinguishing between legal network traffic flows originating from normal traffic activity and illegal network traffic flows generated by DDoS attacks. The hybrid artificial intelligence model 1 DCNN-DT proposed in this study consists of three phases. The overall architecture, including these phases, is presented in Figure 5.  
As shown in Figure 5, the first phase of the proposed 1 DCNN-DT model involves training the CNN architecture. This CNN architecture consists of 3 convolutional layers and 2 fully connected layers, as depicted in Figure 5. In the second phase of the proposed model, deep features are extracted by utilizing the parameters of the trained CNN architecture.