## 2 Background and Description of Datasets
### The Study of [PERSON] et al. [2]  
The second established dataset, termed InSDN, was created by [PERSON] et al. [2]. What makes their work stand out is the fact that instead of only focusing on DDoS attacks for SDNs, their dataset also incorporated several other attacks, namely DoS, web attacks, R2L, malware, probe, and U2R. The dataset consists of 343,939 instances comprised of normal and attack traffic. Of these, 68,424 instances are classified as normal, and 275,515 instances are categorized as attack. They divided the dataset into three groups based on the traffic types and the target machines. The first group includes normal traffic only. In the second group, attack traffic that targets the Metasploitable-2 server is considered. The last group contains attacks on the OVS machine [2]. Table 4 provides the distribution of the instances in each group. Furthermore, in the original dataset, 77 features were identified. Of these, 48 features were selected. Table 5 describes the features in this dataset.  
Like [PERSON] et al., [PERSON] et al. [1; 2] also used some standard ensemble techniques like AdaBoost, rbf-SVM and lin-SVM, and RF classifier. However, the results showed that the accuracy achieved by these techniques, with the exception of RF, was less than that achieved by simple ML algorithms like naive Bayes, KNN, DTs, and multi-layer perceptron (MLP). The most promising results were achieved by the RF classifier. Even though RF showed promising results, the problem with RFs, like most ensemble techniques, is that they require a grid search of the hyperparameters (such as number of trees) to consider, the tree depth, and the number of features to consider for a split. Furthermore, the study of [PERSON] et al. [2], does not mention the encoding techniques incorporated for categorical data.  
\begin{table}
\begin{tabular}{c c c} \hline
**Data Group** & **Number of Instances** & **Percentage** \\ \hline Normal & 68,424 & 19.9\% \\ \hline Metasploitable-2 & 136,743 & 39.76\% \\ \hline OVS & 138,772 & 40.34\% \\ \hline \end{tabular}
\end{table}
Table 4: Number of instances in the [PERSON] et al. dataset [2].  
\begin{table}
\begin{tabular}{c c c} \hline
**No.** & **Attribute Name** & **No.** & **Attribute Name** \\ \hline
1 & Protocol & 25 & Fwd-IAT-Min \\ \hline
2 & Flow-duration & 26 & Bwd-IAT-Tot \\ \hline
3 & Tot-Fwd-pkts & 27 & Bwd-IAT-Mean \\ \hline
4 & Tot-Bwd-Pkts & 28 & Bwd-IAT-Std \\ \hline
5 & TotLen-Fwd-Pkts & 29 & Bwd-IAT-Max \\ \hline
6 & TotLen-Bwd-Pkts & 30 & Bwd-IAT-Min \\ \hline
7 & Fwd-Pkt-Len-Max & 31 & Fwd-Header-Len \\ \hline
8 & Fwd-Pkt-Len-Min & 32 & Bwd-Header-Len \\ \hline
9 & Fwd-Pkt-Len-Mean & 33 & Fwd-Pkts/s \\ \hline
10 & Fwd-Pkt-Len-Std & 34 & Bwd-Pkts/s \\ \hline
11 & Bwd-Pkt-Len-Max & 35 & Pkt-Len-Min \\ \hline
12 & Bwd-Pkt-Len-Min & 36 & Pkt-Len-Max \\ \hline
13 & Bwd-Pkt-Len-Mean & 37 & Pkt-Len-Mean \\ \hline
14 & Bwd-Pkt-Len-Std & 38 & Pkt-Len-Std \\ \hline
15 & Flow-Bytes/s & 39 & Pkt-Len-Var \\ \hline
16 & Flow-Pkts/s & 40 & Pkt-Size-Avg \\ \hline
17 & Flow-IAT-Mean & 41 & Active-Mean \\ \hline
18 & Flow-IAT-Std & 42 & Active-Std \\ \hline
19 & Flow-IAT-Max & 43 & Active-Max \\ \hline
20 & Flow-IAT-Min & 44 & Active-Min \\ \hline
21 & Fwd-IAT-Tot & 45 & Idle-Mean \\ \hline
22 & Fwd-IAT-Mean & 46 & Idle-Std \\ \hline
23 & Fwd-IAT-Std & 47 & Idle-Max \\ \hline
24 & Fwd-IAT-Max & 48 & Idle-Min \\ \hline \end{tabular}
\end{table}
Table 5: Attributes used in the study of [PERSON] et al. [2].  
variables, which would have been necessary for techniques like linear regression, radial basis function networks, SVMs, and MLP.