# Comparative Study of AI-Enabled DDoS Detection Technologies in SDN
## 4 Experiment Analysis and Verification
### Experimental Results
The performance on the basis of the remaining parameters, such as sensitivity, precision and specificity, was evaluated and is shown in the graph in Figure 6. The results again shows the highest values for the random forest and decision tree classifier models. After analyzing the overall and individual performance of our classifier models, we can state that the machine learning-based random forest and decision tree classifier models show better performance in detecting and mitigating DDoS attacks in SDN. \begin{table}
\begin{tabular}{l c c c c c c} \hline \multirow{2}{*}{**Feature Set**} & **Evaluation Time** & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**Sensibility**} & \multirow{2}{*}{**Precision**} & \multirow{2}{*}{**Specificity**} & \multirow{2}{*}{**F1\_Score**} \\ \cline{3-3} \cline{5-6} \cline{7-7} \multicolumn{1}{c}{64} & 5.67 s & & & & & \\ \hline
15 & 4.38 s & 95.450\% & 95.266\% & 95.513\% & 95.630\% & 95.389\% \\
14 & 4.26 s & 96.471\% & 94.103\% & 98.694\% & 98.784\% & 96.344\% \\
13 & 4.13 s & 96.654\% & 94.412\% & 98.760\% & 98.843\% & 96.537\% \\
12 & 4.10 s & 95.349\% & 91.718\% & 98.780\% & 98.994\% & 95.118\% \\
11 & 4.12 s & 96.184\% & 93.226\% & 98.841\% & 98.971\% & 95.951\% \\
10 & 4.17 s & 95.537\% & 96.233\% & 94.812\% & 94.858\% & 95.517\% \\
9 & 4.23 s & 89.137\% & 86.972\% & 90.661\% & 91.251\% & 88.778\% \\ \hline \end{tabular}
\end{table} 
Table 7: Performance of the convolution neural network model (CNN) with permutation importance algorithm. \begin{table}
\begin{tabular}{l c c c c c c} \hline \multirow{2}{*}{**Feature Set**} & **Evaluation Time** & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**Sensibility**} & \multirow{2}{*}{**Precision**} & \multirow{2}{*}{**Specificity**} & \multirow{2}{*}{**F1\_Score**} \\ \cline{3-3} \cline{5-6} \multicolumn{1}{c}{64} & 2.09 s & & & & & \\ \cline{3-3} \cline{5-6} \multicolumn{1}{c}{15} & 4.28 s & & & & & \\ \cline{3-3} \cline{5-6} \multicolumn{1}{c}{14} & 3.78 s & & & & & \\ \cline{3-3} \cline{5-6} \multicolumn{1}{c}{13} & 3.63 s & & & & & \\ \cline{3-3} \cline{5-6} \multicolumn{1}{c}{12} & 3.38 s & & & & & \\ \cline{3-3} \cline{5-6} \multicolumn{1}{c}{11} & 3.28 s & & & & & \\ \cline{3-3} \cline{5-6} \multicolumn{1}{c}{10} & 3.07 s & & & & & \\ \cline{3-3} \cline{5-6} \multicolumn{1}{c}{9} & 3.14 s & & & & & \\ \cline{3-3} \cline{5-6} \multicolumn{1}{c}{8} & 3.27 s & & & & & \\ \hline \end{tabular}
\end{table} 
Table 8: Performance of the recurrent neural network model (CNN) with permutation importance algorithm. As we have analyzed the performance of the classifier models with different feature sets, we now examine and analyze the performance of the classifier models with 10 features. First, we evaluate the overall performance of our classifier models, which is shown in Table 9. The results show the same behavior and random forest is better than the other classifier models. Figure 4: Performance comparison of classifier models in detecting DDoS attacks in SDN. Figure 5: Performance comparison of classifier models in accuracy and F1_Score. Figure 6: Performance comparison of classifier models in sensitivity, precision and specificity. Figure 11: Performance for attack traffic without mitigation in SDN. Figure 12: Performance for attack traffic with mitigation in SDN. Figure 10: Performance for traffic without attacks in SDN. Figure 9: Performance comparison of classifier models in sensitivity, precision and specificity with 10 Features. The results show that the SDN architecture can be the best solution in terms of detecting DDoS attacks with machine learning techniques such as random forest models. With the planned approach, a secure and efficient SDN architecture can be developed. In the SDN topology, the location of the controllers is important at this point. We have shown with our results that a machine learning-based random forest model achieves the best performance by classifying the traffic into attack and normal traffic. We hope to implement our model on a multi-controller SDN network to detect and mitigate DDoS attacks.