## 2 Background and Description of Datasets
### The Study of [PERSON] et al. [1]  
In the work by [PERSON] et al. [1], a simulated dataset was developed using the Mininet emulator and made publicly available on the Mendeley repository. The major work by [PERSON] et al. [1] was the identification of novel features for DDoS attack detection. The original dataset contains a total of 104,345 instances, where each instance is comprised of 23 features before preprocessing. Table 2 provides the details of these instances, while Table 3 shows the features identified in [PERSON] et al. (2018). It is mentioned in [PERSON] et al. (2018) that after preprocessing and including dummy variables for categorical features, the data increased from 23 to 67 features, and that RF produced excellent results with a large number of features. This step implies that encoding was used (as mentioned by [PERSON] et al. (2018)) so that categorical features could be given as input to classifiers that work only on numerical data (like linear regression, SVC, \begin{table}
\begin{tabular}{c c} \hline
**Traffic Class** & **Number of Instances** \\ \hline Benign & 63,561 \\ \hline Malicious & 40,784 \\ \hline TCP & 29,436 (18,897 benign, 10,539 malicious) \\ \hline UDP & 33,588 (22,772 benign, 10,816 malicious) \\ \hline ICMP & 41,321 (24,957 benign, 16,364 malicious) \\ \hline \end{tabular}
\end{table} 
Table 2: Number of instances in the [PERSON] et al. (2018). \begin{table}
\begin{tabular}{c c c} \hline
**No.** & **Feature** & **Description** \\ \hline
1 & dt & Date and time \\ \hline
2 & switch & Datapath ID of the switch in the topology \\ \hline
3 & src & Source IP address of the flow \\ \hline
4 & dst & Destination IP address of the flow \\ \hline
5 & pktcount & Number of packets sent during the flow \\ \hline
6 & bytecount & Number of bytes sent during the flow \\ \hline
7 & dur & Duration of the flow in seconds \\ \hline
8 & dur\_nsec & Duration of the flow in nanoseconds \\ \hline
9 & tot\_dur & Total duration of the flow in nanoseconds \\ \hline
10 & flows & Total number of flows in the switch \\ \hline
11 & packetins & Number of packet\_in messages to the controller \\ \hline
12 & pktperflow & Packet count per flow \\ \hline
13 & byteperflow & Byte count per flow \\ \hline
14 & pktrate & Packet rate calculated using packet counts \\ \hline
15 & Pairflow & Boolean value \\ \hline
16 & Protocol & Protocol associated with the traffic flow \\ \hline
17 & port\_no & Port number of the switch \\ \hline
18 & tx\_bytes & Number of bytes transmitted on the port \\ \hline
19 & rx\_bytes & Number of bytes received on the port \\ \hline
20 & tx\_kbps & Transmit bandwidth of the port \\ \hline
21 & rx\_kbps & Receive bandwidth of the port \\ \hline
22 & tot\_kbps & Total bandwidth of the port \\ \hline
23 & label & The label of the attack \\ \hline \end{tabular}
\end{table} 
Table 3: Features used in the study of [PERSON] et al. (2018). NNet). PCA (principal component analysis) was implemented on the resultant dataset, compressing it to only 20 features. After the application of PCA on the data, t-SNE (t-distributed stochastic neighborhood embedding) was applied, further compressing the dataset from 20 features to 2 features. These two features are then used by a SVC (support vector classifier) to classify the data, but some of the points are situated in such a way that they lie in more than one class. These points are then given as input to an RF classifier for a more accurate prediction. From the literature review performed, the work of [PERSON] et al. [1] stands out in the sense that this paper used an ensemble technique for DDoS detection. Therefore, an in-depth analysis was performed on the steps taken by [PERSON] et al. [1] to identify possible gaps. [PERSON] et al. [42] pointed out that the distance between any two pairs is the same. Another disadvantage of this type of encoding is the extra use of resources to represent information. In the case of [PERSON] et al. [1], it resulted in four times the number of features than the original dataset.