## 6 Performance Evaluation of the SD-VANET_GUARD DDoS Attack Detection System  
In this section, the performance results of the proposed detection module for the security system are examined. The results of the tests conducted on the SD-VANET_Guard attack detection system have been analyzed and presented in detail. In this study, the performance of a Decision Tree model utilizing CNN features has been examined. The model demonstrates consistent success with accuracy, precision, recall, and an F1 score of 99.6%, indicating its capability to accurately detect DDoS attacks and traffic conditions. These high-performance metrics highlight the model's ability to accurately classify positive and negative classes, suggesting its potential as a robust tool for securing intelligent transportation networks. A series of experiments were conducted to evaluate the effectiveness of the SD-VANET_Guard attack detection system in detecting DDoS attacks. In these experiments, the system's performance was tested by initiating mixed types of DDoS flood attacks, such as TCP/SYN flood and UDP flood, while the system was operational. Table 3 presents detailed information regarding the start times of each module. In the first scenario, the 1 DCNN-DT hybrid model, which had been trained using a pre-constructed training dataset, was executed at 17:54:00. At the same time, an initiation command was issued for the attack detection module, activating it successfully. The detection module identified the DDoS attack at 17:58:00. Simultaneously, the Ryu controller started generating flow rules in response to flow requests from the data plane devices at 17:54:00. The DDoS attack itself was initiated at 17:57:30. Due to the dynamic nature of the VANET architecture, intermittent communication breakdowns occurred between the controller and the data plane devices. As a result of this mobility-induced network instability, delays were experienced in the transmission of flow requests from the data plane to the controller, leading to the detection of the attack only at 17:58:00. In a DDoS attack, the attacker uses compromised computers, turned into zombies, to continuously send requests to Access Points (APs). When these requests do not match the rules present in the flow tables of the APs or Roadside Units (RSUs) (resulting in a flow miss), \"OFPT PACKET_IN\" messages are transmitted to the controller via the RSUs or APs using the OpenFlow protocol, prompting the creation of new flow rules. Due to the DDoS attack, a large number of packets are sent from the data plane devices to the controller within a short period (Figure 7). As illustrated, a surge in packet transmission from the data plane to the controller occurred at 17:57:30, coinciding with the initiation of the DDoS attack. The controller responds to these incoming flow rule requests using \"OFPT PACKET_MOD\" messages. This leads to resource exhaustion of the controller (memory, CPU, bandwidth, etc. ), causing network malfunction. As shown in Figure 8, the increasing flow of rule requests from 17:57:30 onwards overwhelmed the controller's processing capacity, resulting in CPU usage reaching 100%. In the experimental study, a DDoS attack was generated using the Hping3 packet generation tool, where the attacker directed high-volume attack traffic at a rate of 4.55 Mb/s per second through the data plane devices. The incoming packets were matched against the flow entries in the OpenFlow switch's flow table; however, if no match was found (miss flow), the packets were forwarded to the controller via \"OFPT_PACKET_IN\" messages, requesting the creation of a new rule. Consequently, the controller received a large number of \"OFPT_PACKET_IN\" messages within a short period. In response to these rule requests, the controller created new rules and transmitted them to the switch's flow table.