## 5 Experiment Results and Discussions
### Detecting Unknown Saturation Attacks Using Semi-Supervised Machine Learning  
It is challenging for machine-learning-based detection systems to detect new attacks which the classifier has not yet observed in the training phase. This is because the standard  
Figure 5: The detection performance of supervised classifiers using SDN simulation environment. (**a**) K-NN performance on different time windows on simulation environment; (**b**) SVM detection performance on different time windows on simulation environment; (**c**) NB detection performance on different time-windows on simulation environment. approach of the ML-based detection system is to train the classifier to detect all known attack classes. Therefore, the training datasets should contain a large number of specimens for each attack class and include all real-life attacks [25], which is hard to obtain. Thus, ML-based DDoS detection systems are not widely used in real-life environments because they cannot detect the unknown attacks. In this paper, we investigate the detection performance of SVM, K-NN, and NB supervised classifiers for identifying unknown saturation attacks. An unknown attack is an attack that has been mislabeled by the trained model due to the absence of similar samples in the training dataset. Then, we compare the detection performance of the semi-supervised classifiers in detecting unknown attacks. In our approach, the semi-supervised classifiers are trained using the normal datasets that consists of only normal traffic samples. In our experiments, in order to create unknown attacks, the targeted attack observations and its combinations are excluded from the training dataset. Hence, the training dataset includes only samples of other attacks, their combinations, and normal traffic samples. The testing dataset is composed of the unknown attack samples and randomly selected normal traffic samples. Assuming that \(R\) is the training dataset which includes all attack samples and normal traffic samples, \(W\) is the testing dataset that includes both normal and attack samples, \(U\) is the unknown attack observations, and \(Z\) is the observations of attack combination, then  
\[R_{trainingDataset}=R-U-Z \tag{1}\]  
\[W_{testingDataset}=U+NormalTrafficSamples \tag{2}\]  
Using the best-case training method in which one type of attack is excluded from the training dataset, the K-NN, SVM, and NB classifiers can detect the unknown attack as depicted in Figure 6. Specifically, the K-NN classifier obtains high detection results in detecting unknown saturation attacks. We hypothesize that all the different attacks in the training set allow the classifier to generalize the missing attack. To confirm this hypothesis, we use the worst-case training method. In this case, the training dataset has only one type of attack in addition to the normal samples. In our experiments, we consider the K-NN classifier (our best choice) only, and it is trained using one type of attack. The results in Table 4 show that the K-NN, in the worst-case scenario, is not able to efficiently detect the unknown attacks. This means, in general, that supervised classification is unsuitable for detecting unknown SDN attacks. For these reasons, we consider studying semi-supervised classifiers, such as isolation forest, one-class SVM, autoencoder, and variational autoencoders for attack detection. Figure 6: The performance of supervised classifiers in detecting unknown saturation attacks using the best-case training method. In this case, the training set comprises only the normal instances, whereas the testing set consists of all the normal and attack instances. Table 5 shows the average results of the 10-fold cross validation. In the worst-case scenario, the semi-supervised classification algorithms have higher detection performance of unknown saturation attacks with respect to supervised ones.