## 3 Novelty and Contributions  
Recent studies [53; 54] show that simulated datasets used for attack detection usually yield high accuracy. However, their implementation in a real environment does not give the same level of accuracy. This is due to the patterns of values that are not present in the simulated dataset. Thus, it is of extreme importance to adjust the model in accordance with the real-world environment. The problem with most advanced ML models is that these models are not interpretable enough to allow the user to infer the relationship between feature values and classifications [55]. In the case of [PERSON] et al. [1], the best accuracy was achieved by first implementing SVCs and then applying RF. SVCs are not easily interpretable [56]. [PERSON] et al. [2] achieve excellent results via RF classifiers, which are interpretable but not as interpretable as single DTs, as RF classifiers pose the problem of multiple tree aggregation [57]. Therefore, what is most desirable is an easily interpretable model [58], whose functionality can be understood in the field environment. This is the direction that the approach proposed in the present study has taken.  
As mentioned earlier, the preliminary work by [PERSON] et al. [40] provided limited insights about DDoS attack detection in SDNs through a basic analysis on the impact of feature selection in the context of the problem. The study only used a single dataset, and without providing any comparison with other works reported in the literature or improvement in existing core techniques.  
The key limitations of the two core studies by [PERSON] et al. [1] and [PERSON] et al. [2] have been highlighted above. Keeping in view these observations and the above discussion, the novel aspects and key contributions of the present study are enumerated as follows:  
1. In the past studies on the detection of DDoS attacks, SDN-specific datasets were not available or not utilized. As such, the main focus in those studies was the creation of datasets. In the present study, our contribution is in utilizing two recent and core datasets for the underlying problem while utilizing a decision-tree-based approach. The availability of two datasets has enabled us to verify that the detection of malicious and benign network traffic is closer to how it appears in reality, as opposed to being biased towards how it is represented in a single dataset.
2. The previous technique by [PERSON] et al. [1] had multiple steps involved, which increased the complexity of the overall algorithm. In the technique proposed herein, certain algorithmic layers and encoding techniques have been removed altogether, and there is no implementation of t-SNE (see details in the next section). This removal results in the proposed approach being simpler. Furthermore, [PERSON] et al. [2] applied RF directly to their dataset, but random forest requires certain parameters' selection, which leads to a grid search for optimization. Our contribution is in proposing a technique that avoids the above issues, leading to a simpler and time-efficient approach.
3. In the present study, a simple algorithm enhancement to the decision tree algorithm, called the greedy decision tree (GDT), is proposed. The GDT technique involves iteratively constructing a DT, selecting features that give the best results when added to the previously constructed DT. It is shown that the results of this approach are comparable or better than those obtained by [PERSON] et al. and [PERSON] et al [1; 2].
4. Stability analysis of the GDT algorithm is performed to demonstrate its behavior under different conditions while using the aforementioned two SDN-specific datasets.