# Intelligent Traffic Management in Next-Generation Networks
## 3 DL/ML Applications in Software-Defined Networking
### Network Security
#### 3.3.3 Discussion  
Different ML/DL-based models have been used for intrusion detection/classification. Despite the performance of DL models, many solutions use conventional ML models (shown from Table 10) due to their simplicity. However, these models are usually accompanied by some dimensionality reduction methods. Additionally, as seen in the literature review, the detection of DDoS attacks has attracted many researchers. In other words, since the SDN controller represents the central brain of the network that stores and processes the data from all forwarding devices, it can be targeted by DDoS attacks. Moreover, FL can be used to improve the security and privacy of the end-users by keeping the traffic at the level of the data plane without damaging the controller. It is able to involve a massive number of forwarding devices which are important for training DL models. Therefore, by only sharing the local update of the global model between the forwarding devices and the controller, the communication overhead may be reduced, hence speeding up the attack detection/classification. \begin{table}
\begin{tabular}{p{42.7 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Ref. ** & **Category** & **ML/DL Model** & \begin{tabular}{} \end{tabular}  & **Controller** & **Contribution** \\ \hline
[45] & Intrusion detection & DNN & - & N/A & The first application of the DL approach for intrusion detection in the SDN environment. \\ \hline
[127] & Intrusion detection & GRU-RNN & - & POX & The authors achieve a good performance using the GRU-RNN model with only six features. \\ \hline
[135] & DDoS detection & XGBoost & Filter method & POX & The XGBoost algorithm has strong scalability and higher accuracy and a lower false positive rate than random forest and SVM. \\ \hline
[136] & DDoS classification & SAE & AE & POX & Before the DDoS attack detection task, the authors used SAE for feature reduction in an unsupervised manner. \\ \hline
[120] & DDoS classification & GAN & - & Floodlight & The authors used GAN to make their system more efficient against adversarial attacks. \\ \hline
[125] & Attack classification & RF & Filter method & N/A & The authors used an upgrade metaheuristic algorithm for feature selection and RF as a classifier. \\ \hline
[124] & Attack classification & AdaBoost & Wrapper method & N/A & The authors demonstrate that using the feature selection method improves the attack classification task as well as produces a low overhead system. \\ \hline
[137] & DDoS detection & LSTM, CNN, RNN & - & N/A & The authors have compared different DL-based models. \\ \hline
[138] & DDoS detection & CNN & - & N/A & The authors proposed an ensemble CNN model for the DDoS attack detection and compared its performance with other known DL-based models using a benchmark dataset. \\ \hline
[139] & DDoS classification & AE+RF & AE & Ryu & The authors proposed a hybrid ML approach by combining deep learning and conventional ML models. The AE is used to extract a reduced version of the initial features, and the RF acts as the main classifier of the system. \\ \hline
[129] & Attack classification & CNN+SVM, CNN+RF, CNN+DT & CNN & N/A & The authors demonstrate the potential of CNN for anomaly detection even with a few amount of features (9 features). Additionally, the combination of CNN and SVM, KNN, and especially the RF algorithm enhances the detection rate and provides a higher performance compared to the single CNN. \\ \hline
[134] & DDoS detection & SVM, Naive-Bayes, DT, and Logistic Regression & N/A & POX & The authors compare the performance of different well-known ML-based models, including SVM, Naive-Bayes, DT, and logistic regression. \\ \hline
[123] & Intrusion detection & DT, RF, AdaBoost, KNN, SVM & PCA & N/A & The authors focused on a comparative analysis between different conventional ML-based models for the intrusion detection task using a benchmark dataset (NSL-KDD dataset).