# Feature-Selection-Based DDoS Attack Detection Using AI Algorithms
## 2 Related Works and Contribution
### ML Deployment for DDoS Attack Detection  
For the purpose of creating and optimizing models, [PERSON] et al. [15] suggest sending real-time traffic data to an off-line learning pipeline. Data are gathered via routers and transmitted to the pipeline for feature engineering and data transformation. They can be used in conjunction with an existing model to defend the network from DDoS assaults. For the purpose of detecting DDoS attacks using DNS queries, [PERSON] et al. [16] provide an SDN-based Dirichlet Process Mixture Model (DPMM) clustering technique. This implies that many projections will be wrong. According to [PERSON] et al. [17], a flow is assumed to be a vector with values for the length, duration, size, and rate of the flow. Four internet service providers were connected to one another in a set-up scenario by [PERSON] et al. [18]. They take into account the possibility of an ML server using NB classification \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Paper** & **AI Techniques** & **Dataset** & **Features** \\ \hline
[13] & DA, SVM, KNN, NB, and & &
\begin{tabular}{c} Number of bytes sent by source and destination number of packet sent by source, flow duration, and number of bytes divided by number of packets sent by source and destination \\ \end{tabular} \\
[14] & SVM, KNN, NN, and NB & Self-generated traffic & 12 features including the number of packets received on the control plane \\
[15] & Apache spark & DDoS\_CHARGEN AND & Source/destination IP, source/destination port number, protocol, packet length, number of bytes, and timestamp \\
[16] & DPMM & Dataset generated by other & Number of packets transmitted, ratio of source and destination bytes, and connection duration time \\
[17] & KNN, NB, and SVM & Self-generated traffic & Flow length, flow duration, flow size, and flow rate \\
[18] & NB & NSL-KDD & 25 features in total including protocol and duration \\
[19] & Soft-max, NN and, & Self-generated traffic & 34 from TCP, 20 UDP, and 14 features from ICMP flows \\
[20] & SVM & KDD1999, KDD CUP 1999 & 30 features including protocol and flag \\
[21] & RF, SVM, XGBoost, DT, & CIC-IDS2018 & 26 features selected \\
[22] & DNN, LSTM, and GRU & CICDDoS2019 and & No features selected \\
[23] & CNN & KDD cup 99 & Features extracted automatically (not mentioned) \\
[24] & LSTM-CNN and RNN & Self-generated & No features selection \\
[25] & Cybernet & CICDDoS2019 & Not Given \\
**Our paper** & RF, DT, CNN, SGD, and & CICDDoS2019 (SYN and & 16 features selected including source port and \\  & NGBooST Classifier & NeTBIOS) & destination port \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._operating outside of this network. To analyze network traffic, [PERSON] et al. [19] suggest running three modules--Traffic Collector and Flow Installer (TCFI), Feature Extractor (FE), and Traffic Classifier (TC)--over the controller. SVM is used by [PERSON] et al. [20] in conjunction with the sFlow toolset to detect threats to SDN. The model pulls behavioral variables, such as protocol type, for SVM training from traffic statistics it gathers from switches via the controller. SVM can identify an attack by contrasting normal and malicious behavioral profiles. This research provides a feature-engineering- and machine-learning-based technique for detecting DDoS assaults in SDN. First, the CSE-CIC-IDS2018 dataset was cleaned and normalized, and the best feature subset was identified using an enhanced binary grey wolf optimization approach [21]. This research proposes DL-2P-DDoSADF, a deep-learning-based two-phase DoS attack detection system. The suggested approach has been validated using the CICDDoS2019 and DDoS-AT-2022 datasets. The performance and efficacy of several deep learning approaches, including Deep Neural Networks (DNN), Long Short-Term Memory (LSTM), and Gated Recurrent Units (GRU), are compared [22]. A two-phase technique for DDoS attack detection and mitigation is introduced by the framework.