# Optimized MLP-CNN Model to Enhance Detecting DDoS Attacks in SDN Environment
## 3 Background
### Optimization  
Optimization is a fundamental aspect of enhancing the effectiveness and efficiency of ML models. When it comes to DDoS-attack detection, fine tuning model hyperparameters, selecting relevant features, and optimizing the model architecture are crucial. The optimization algorithm then iteratively adjusts the model's parameters to minimize the objective function by using various optimization techniques such as Bayesian optimization and ADAM optimizer. Bayesian optimization is a potent ally among the arsenal of advanced techniques available. Bayesian optimization is a sophisticated strategy rooted in Bayesian statistical principles, designed to master the optimization of complex and computationally demanding functions. This technique shines when confronted with vast search spaces and resource-intensive evaluations, as commonly encountered in hyperparameter tuning and feature selection. At its core, Bayesian optimization revolves around creating a probabilistic model, often termed a \"surrogate model,\" that approximates the target objective function. This surrogate model, which can take the form of a Gaussian process (GP) or even a deep neural network, plays a crucial role in estimating the objective function's behavior [30]. Surrogate Modeling: Bayesian optimization begins with establishing a prior distribution over the objective function. In conjunction with available data, this prior allows the surrogate model to approximate the objective function's behavior. The surrogate model is typically represented as a GP, which predicts accurate function values for different inputs. The prior and posterior distributions of the GP are defined as follows:  
\[Prior:f(x)\sim\text{GP}(\mu(x),\kappa(x,x^{\prime})) \tag{4}\]  
\[Posterior:f(x)\mid X,y,x^{\prime}\sim\text{GP}(\mu^{\prime}(x),\kappa^{\prime}( x,x^{\prime})) \tag{5}\]  
_where_\(f(x)\) represents the function modeled by the GP. * \(\mu(x)\) is the mean function of the GP. * \(\kappa(x,x^{\prime})\) is the GP's covariance function (kernel). * \(X\) is the set of input points. * \(y\) is the observed data. * \(x^{\prime}\) is the point for which we want to make predictions. * \(n^{\prime}(x)\) is the mean function of the posterior GP. * \(\kappa^{\prime}(x,x^{\prime})\) is the covariance function (kernel) of the posterior GP. Equations (4) and (5) capture the prior and posterior distributions used in Surrogate Modeling in Bayesian optimization, where the GP approximates the objective function based on available data. The acquisition function: It guides the search for the optimum by quantifying the value of evaluating the objective function at different points. It balances exploration (sampling from areas where the surrogate model is uncertain) and exploitation (sampling where the surrogate model predicts high objective values). The acquisition function, often represented as \(\alpha(x)\), guides the selection of the next evaluation point. One commonly used acquisition function is the Expected Improvement (EI):  
\[\alpha_{\text{EI}}(x)=\mathbb{E}[\max(f(x^{\prime})-f(x_{\text{best}}),0)] \tag{6}\]  
_where_  
* \(\alpha_{\text{EI}}(x)\) is the Expected Improvement acquisition function. * \(f(x^{\prime})\) is the predicted function value for a candidate point \(x^{\prime}\). * \(f(x_{\text{best}})\) is the best observed function value so far. * \(\max(\cdot)\) returns the maximum of the values inside the parentheses. The Point Selection: The acquisition function is employed to choose the next point for evaluation. This point is then assessed on the true objective function. The point to be evaluated next, \(x_{\text{next}}\), is chosen by maximizing the acquisition function:  
\[x_{\text{next}}=\arg\max_{x}\alpha(x) \tag{7}\]  
In Equation (7), \(x_{\text{next}}\) represents the next point selected for evaluation, and \(\alpha(x)\) is the acquisition function, such as EI, that guides the choice of the next evaluation point.