# An Adversarial DBN-LSTM Method for Detecting and Defending against DDoS Attacks in SDN Environments
## 2 Related Work  
[PERSON] et al. [11] proposed the adversarial robustness of neural networks through the lens of robust optimization. They use a natural saddle point min-max formulation to capture the notion of security against adversarial attacks in a principled manner. Their work showed that the specially designed deep learning structure could effectively resist adversarial attacks. [PERSON] et al. [12] proposed sFlow and adaptive polling-based sampling with a Snort IDS and deep-learning-based model. Based on the flexible decoupling characteristics of SDN, this method can effectively reduce the impact of DDoS attacks. On the one hand, they deployed sFlow and adaptive polling-based sampling individually to reduce the calculation overhead of the SDN switch in the data plane. On the other hand, they optimized the SAE model and combined it with IDS to detect DDoS attacks in the control plane. Their work provides an excellent example of how to use the advantages of SDN to combine the deep learning model to realize the identification of DDoS attacks. [PERSON] et al. [13] proposed a low-cost approach for DDoS attack classification. This study combined CNN and LSTM and designed extreme gradient boosting. Their method can make the device not need to pay high computational power and can be well applied to IoT devices with low computational power. Their performance results show that the proposed model achieves high accuracy with a low time cost. [PERSON] et al. [14] proposed that the DL-model-driven SDN enabled IDS to be confronted with significantly less frequent attacks in SDN. In this study, the DNN model processes the data, and the corresponding data are sent into the designed LSTM model. The proposed model is trained on the CICIDS 2018 dataset. This model realized the detection of network attacks with higher accuracy and precision. However, this method does not take advantage of the characteristics of SDN and focuses more on improving the deep learning method itself. [PERSON] et al. [15] proposed an IDS based on adversarial training in SDN. The difference from other studies is that this study further considers the impact of adversarial attacks on the system and implements the design of the GAN framework in the SDN environment. Their model avoids the impact of adversarial attacks and enables the model to detect DDoS attacks more accurately. Their experiments show higher accuracy compared with similar schemes with the public dataset CICDDoS 2019. [PERSON] et al. [16] proposed an effective hybrid DL model (CNN + BiLSTM) enhanced with the feature selection approach. This method built an x\({}^{2}\) test for feature selection and then utilized a CNN + BiLSTM hybrid model for DDoS attack classification. This method used the x\({}^{2}\) test to identify highly rated features that contribute considerably to predicting court case judgments and used a CNN to extract such high-rated features. Moreover, these features are then input into a BiLSTM model, which maintains the prior and future context of the provided data. This method can predict DDoS attack outcomes from data using both optimum feature selection and CNN and BILSTM layers. [PERSON] et al. [17] proposed an SDN defense system based on the analysis of single IP flow records, which uses the gated recurrent units (GRU) deep learning method to detect DDoS and intrusion attacks. This direct flow inspection enables faster mitigation responses, minimizing the attack's impact on the SDN. The proposed model is tested against several different machine learning approaches over two public datasets, the CICDDoS 2019 and the CICIDS 2018. [PERSON] [18] developed an SDN-enabled DL-driven solution for the detection of threats in the IoT environment that is cost-effective and highly scalable. They used a hybrid technique comprising the Cuda-deep neural network long short-term memory (CuDNNLSTM) and Cuda-deep neural network gated recurrent unit (CuDNNGRU) algorithms for efficient threat detection.