## 4 Experimental Result
### Dataset Generation  
This study generates several datasets based on the topology shown in Figure 2 to evaluate the effectiveness of the proposed approach in detecting low and high DDoS attack traffic rates on the controller due to a lack of available benchmark datasets. The generated databases include both normal and abnormal network traffic. Each dataset aggregates network traffic every 5 s, representing different attack scenarios. The attack scenarios are (i) a low-rate DDoS attack on a single victim host by a single host (LSS), (ii) a high-rate DDoS attack on a single victim by a single host (HSS), (iii) a low-rate DDoS attack on  
Figure 2: Experimental network topology. multiple victim hosts by a single host (LMS), (iv) a high-rate DDoS attack on multiple victim hosts by a single host (HMS), (v) a low-rate DDoS attack on a single victim host by multiple hosts (LSM), (vi) a high-rate DDoS attack on a single victim by multiple hosts (HSM), (vii) a low-rate DDoS attack on multiple victim hosts by multiple hosts (LMM), and (viii) a high-rate DDoS attack on multiple victim hosts by multiple hosts (HMM). These eight scenarios are replicated from previously published work [41]. The diversity of scenarios is required to evaluate the robustness of the proposed approach to detect DDoS attacks on SDN controllers under different circumstances. In addition, to the best of the authors' knowledge, the employed dataset is the first to cover all DDoS attack scenarios on the SDN controller. Each simulation scenario lasts 60 min. The results of the average detection rate and the false positive rate will be presented every 10 min. Table 2 lists the total number of normal and attack traffic packets in a DDoS attack targeting a single victim for 60 min in eight different scenarios. The virtual network topology created on the Mininet network emulator comprises 64 hosts with IP addresses ranging from 10.0.0.1 to 10.0.0.64; a POX controller; an OpenFlow [45] switch, which has been widely used by researchers, such as by [28] and [44]; therefore, it has been selected in this research; and an attacker running Kali Linux, a Debian-based Linux distribution built for penetration testing and security research. All hosts run Ubuntu Linux OS and Python programming language. Furthermore, the experiment's workstation runs on a 2.20 GHz Intel(r) Core i5-5200U CPU with 8 GB of RAM and a 500 GB hard drive. Suppose a single attack packet is sent in 0.2 s, then the send rate is five packets per second. Therefore, every five seconds, the total number of attack packets sent will be 25. The five packets per second sent rate indicates a low-rate DDoS attack, as stated in [44]. Meanwhile, for the high-rate attack scenario, if a single attack packet is sent in 0.03 s, then the total number of attack packets sent per second is 33. The 33 packets per second sent rate indicates a high-rate DDoS attack, according to [44]. Therefore, for a single attacker scenario with a low DDoS attack traffic, the total number of attacks and normal packets sent in five seconds is 25 and 63 \(\times\) 5 = 315, respectively, regardless of the number of targets (single or multiple victims). As for the multiple attacker scenario with a low-rate DDoS attack, the total number of attacks and normal packets sent in five seconds is 75 and 61 \(\times\) 5 = 305, respectively, regardless of the number of targets (single or multiple victims). Meanwhile, in a single attacker scenario with a high-rate DDoS attack, the total number of attacks and normal packets sent in five seconds is 166 and 63 \(\times\) 5 = 315, respectively, regardless of the number of targets (single or multiple victims). As for the multiple attacker scenario with a high DDoS attack traffic rate, the total number of attacks and normal packets sent in five seconds is 500 and 61 \(\times\) 5 = 305, respectively, regardless of the number of targets (single or multiple victims).