# Comparative Study of AI-Enabled DDoS Detection Technologies in SDN
## 1 Introduction  
SDN [1] has gained popularity due to the services and benefits that it provides, such as scalability, flexibility, and monitoring [2]. In the past decade, devices connected to the internet have increased enormously, which has led to different problems with traditional networks, and one of them is the management of networks. To resolve this issue, a new paradigm, software-defined networking, has been proposed. The whole network's management and configuration is performed through a controller, which simplifies the network management [3]. The separation of the control and data planes plays a critical role by providing high performance in large-scale network systems, but the simplified network management comes with the cost of centralization. In an SDN environment, one can simply enforce policy and network configurations in real time through the controller [4]. However, the controller is a single point that has the ability to control the whole network, and if the controller is compromised, then the whole network can fall under attack. The SDN controller exposes the network to a variety of security threats; among them are DDoS attacks. A DDoS can render the controller or OpenFlow switch overwhelmed if the network is not reasonably secured. In a DDoS attack, a number of bough requests are sent to the controller, which makes the network slow and affects the legitimate traffic. DDoS attacks also expose the data plane through the flow table. To protect the SDN controller from DDoS attacks, intrusion detection systems have been used in the network to sniff thepackets and alert the administrator when a DDoS attack is detected, and many researchers have conducted research aimed at detecting and mitigating DDoS attacks using different techniques. Recently, machine and deep learning-based approaches have been shown to be more dynamic, efficient, and intelligent solutions for SDN management. In this paper, we study both approaches, aiming to determine the most suitable artificial intelligent algorithm to detect a DDoS attack in SDN. The goal of this paper is to detect a DDoS attack in an SDN environment without compromising the security and effecting the legitimate traffic, ensuring high-level security against DDoS attacks on SDN. We achieve this through applying different machine and deep learning algorithms. Firstly, the traffic is analyzed by SDN controller rules set by the network administrator. We further analyze the traffic and divide it into legitimate and attack traffic using different algorithms. We use machine learning-based random forest, decision tree and naive Bayes algorithms and a deep learning-based convolution neural network and recurrent neural network for the classification of traffic. For the learning and testing of the model, we use the Kaggle dataset to check the DDoS detection performance. Finally, the 20 features that affect DDoS detection are determined by applying the two-step permutation importance algorithm (PIA) to the original Kaggle data. Our contributions in this paper are as follows. Firstly, it is possible to reduce the amount and collection time for DDoS attack datasets, which affects the performance of the learning model. Secondly, we can reduce the time and cost of comparing various learning models and their performance in determining a learning model suitable for DDoS detection. We verify that it is possible to reduce the detection time of DDoS and appropriately utilize it when determining a detection model. Finally, various experimental methods to evaluate the performance of the learning model are presented so that related researchers can utilize them. Based on the results of this study, we are currently developing a new learning model for DDoS detection and mitigation in a blockchain network environment and are conducting experiments and verification in real environments. The rest of the paper is organized into the following sections. Section 2 describes the research background and related work previously conducted regarding the detection of DDoS attacks in SDN.