# Optimized MLP-CNN Model to Enhance Detecting DDoS Attacks in SDN Environment
## 4 Proposed Model
### OptMLP-CNN Detector
It is calculated as

\[Recall=\frac{TP}{TP+FN} \tag{22}\]

F1-Score: This metric harmonizes precision and recall, offering a balanced assessment of a model's performance. It is computed as the harmonic mean of precision and recall

\[F1\text{-}Score=2\times\frac{Precision\times Recall}{Precision+Recall} \tag{23}\]

Area Under the Receiver Operating Characteristic Curve (AUC-ROC): The AUC-ROC is a graphical representation that showcases a classifier's performance. It plots the true positive rate against the false positive rate, providing a visual performance indicator. The AUC value quantifies the classifier's accuracy, with higher values indicating superior performance. The choice of performance evaluation metrics, including accuracy, precision, recall, F1-score, and AUC-ROC, reflects a meticulous consideration of various assessment dimensions essential for a holistic model evaluation. Accuracy stands as a fundamental indicator, quantifying the ratio of correctly predicted instances to the total. Precision accentuates the model's prowess in identifying true positives among all positive predictions, while recall illuminates its capacity to capture all actual positives. The F1-score, a harmonic mean of precision and recall, offers a balanced assessment. Additionally, the AUC-ROC provides insights into the model's discriminative ability across classes. This suite of metrics ensures a comprehensive understanding of the model's performance, offering nuanced insights into its strengths and potential limitations across diverse performance aspects. ### Detection Phase

Figures 3 and 4 portray the outcomes derived from conducting the SHAP-feature-selection experiment by using the CICDDoS2019 and InSDN datasets, respectively, within the framework of the OptMLP-CNN model. These visual representations encapsulate the fluctuating landscape of feature importance, quantified through Shapley values, across varying subset sizes. These graphics serve as powerful tools, offering deep insights into the pivotal features that significantly influence the OptMLP-CNN model's efficacy in identifying and

flagging DDoS attacks. Through meticulous scrutiny of these figures, we can discern the features exerting substantial influence on the model's predictive outcomes. This scrutiny steers the strategic decision-making process regarding feature inclusion or exclusion, consequently bolstering the model's proficiency and accuracy in detecting DDoS attacks within the intricate realms of SDN environments. Figures 3 and 4 facilitate

Figure 4: SHAP summary plot using InSDN dataset. Figure 3: SHAP summary plot using CICDDoS2019 dataset. the enhancement of feature-selection methodologies, thereby contributing substantively to the evolution of more robust and effective DDoS-detection models. The correlation matrices depicted in Figures 5 and 6 offer comprehensive insight into the inter-relationships among the 20 selected features obtained through the SHAP-selection method applied to the CICDDoS-2019 and InSDN datasets, respectively. Each cell in these matrices represents the correlation coefficient between a pair of features, ranging from \(-1\) to \(1\). A coefficient of \(-1\) indicates a perfect negative correlation, signifying that as one feature increases, the other decreases in proportion. Conversely, a coefficient of one signifies a complete positive correlation, indicating that both features either increase or decrease simultaneously. A correlation coefficient of \(0\) denotes no linear relationship between the features. This visualization serves as a pivotal tool to unearth redundant features and discern the most influential ones in shaping the DDoS-detection model's performance within these datasets. Figure 5: Correlation of selected features in CICDDoS-2019. Figure 6: Correlation of selected features in InSDN. The performance evaluation of the optimized MLP-CNN model, detailed in Table 2 and Figure 7, showcases its effectiveness in detecting DDoS attacks, a critical concern within network security, especially in SDN environments.