## 4 Proposed Model Structure  
The proposed DDoS detection model presents the implementation of SDN along with a method using deep learning to classify network traffic and construct a classification model. The proposed model includes a 2-hidden-layer autoencoder network with sigmoid activation functions, as shown in Figure 1. Model testing is carried out using the intrusion detection evaluation dataset ISCXIDS2012 [27], as recommended in [28]. During attack simulations, the controller routes the traffic entering the SDN platform by modifying the flow tables. By examining the flow table's rules, the controller can decide whether to forward, drop, or block traffic, employing machine-learning algorithms to determine the optimal routing path. The algorithm provides a knowledge base for decision-making when classifying new flow instances, taking information from previously known classes in the supervised learning portion. In supervised learning, the input-to-output relationship is modeled in two phases: Training and examination. In training, the classification model is constructed by analyzing the training dataset during the learning phase, i.e., the training process. Using the 'TCP-dump' networking tool, data in the form of 'pcap' files are captured in real-time. This allows for labels to be added to network traces in real-time, indicating that these traces can then be used for training. During the testing phase, new insta  
Figure 1: Proposed deep-learning model with autoencoder structure. the model developed during the training phase. The mapping between active and output network traffic is determined using the supervised learning algorithm. The first obstacle to network traffic classification is obtaining a labeled dataset. Using a portion of the data as a training set (e.g., 80% for training) and the remainder as a testing set (e.g., 20% for testing) is one solution. The second obstacle is the possibility of newly generated network traffic to not belong to known traffic classes. The third obstacle is classifying traffic in real-time, i.e., during the online mode. Based on [29], the following flow instance data can be used to train a DL algorithm:  
* Source IP, as well as destination IP along with port number;
* The protocol type (TCP, UDP, or ICMP) and header length;
* The number of packets transmitted at every switch;
* The number of packets received at each switch;
* The packet count (the number of packets within each flow). In SDN infrastructure, the controller is an agent. The controller monitors the network status to make decisions regarding data forwarding:  
* Feature extraction through normalization and autoencoder;
* Training the model using deep neural network;
* Classifying the traffic for one of the two classes: Normal and DDoS. An autoencoder is a feedforward neural network that has one or more hidden layers. It is a type of unsupervised neural network, where the network attempts to match outputs to input vectors as closely as possible. Additionally, it can be used to generate higher or lower dimensionality representation of inputted data. The use of unsupervised learning of compressed data encoding makes neural networks extraordinarily versatile. In addition, these networks can be trained one layer at a time, which minimizes the computational resources needed to design an effective model [30]. If the hidden layers are less dimensional than the input and output layers (as shown in Figure 2), then the network will be used for data encoding (as it allows for compression). Multilayered autoencoders can be trained in series, allowing for the gradual compression of information, creating what is called a stacked autoencoder [31]. Figure 2: Deep autoencoder. The self-encoding model consists of input, hidden, and output layers. The flow table feature vector is [32]:  
\[x_{i}=\left[x_{i1},x_{i2},x_{i3},\ldots,x_{ij}\right]^{T}\]  
where \(i\) represents the \(i\)-th flow table feature vector, and \(j\) represents each flow table feature. The vector contains \(j\) features.