# Optimized MLP-CNN Model to Enhance Detecting DDoS Attacks in SDN Environment
## 4 Proposed Model
### OptMLP-CNN Detector
Our assessment covers two distinctive datasets, CICDDoS2019 and InSDN, providing insights into attack patterns in conventional and SDN infrastructures. The chosen performance metrics offer a comprehensive overview of the model's accuracy and efficacy, and our model demonstrates remarkable prowess in identifying malicious network traffic. For the CICDDoS2019 dataset, the model's accuracy score 0.999504 signifies its exceptional precision in predicting class labels with minimal classification errors. With a precision score of 0.999009, the model accurately identifies DDoS attacks while maintaining an impressively low rate of false positives, crucial for minimizing false alarms and ensuring accurate attack predictions. Its recall score of 0.999752, representing the true positive rate, showcases the model's efficiency in capturing genuine DDoS attacks while demonstrating very few false negatives. Moreover, the F1-score of 0.999381, a balance between precision and recall, highlights the model's ability to classify attacks while minimizing false negatives accurately. This underscores its capability to achieve high accuracy while effectively managing false alarms. Additionally, the AUC score of 0.997901, observed in the AUC-ROC, emphasizes the model's robust discriminatory power in effectively discerning benign and malicious network traffic. The model maintains its exceptional performance by transitioning to the InSDN dataset, which reflects the unique landscape of SDN network environments. With an accuracy score of 0.999802, the model demonstrates its efficacy in classifying network \begin{table}
\begin{tabular}{l l l l l l} \hline \hline
**Dataset** & **Accuracy** & **Precision** & **Recall** & **F1-Score** & **AUC** \\ \hline CICDDoS-2019 & 0.999504 & 0.999009 & 0.999752 & 0.999381 & 0.997901 \\ InSDN & 0.999802 & 0.999858 & 0.999717 & 0.999787 & 0.999601 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: OptMLP-CNN evaluation. Figure 7: Metrics of the OptMLP-CNN. traffic, even within the specialized realm of SDN. The precision score is equally impressive at 0.999858, highlighting the model's ability to classify instances as DDoS attacks within the SDN context accurately. Furthermore, the recall score of 0.999717 signifies the model's capability to identify most actual DDoS attacks in SDN networks while minimizing false negatives. The F1-score of 0.999787 strikes an optimal balance between precision and recall, reinforcing the model's robust performance in DDoS-attack detection. The AUC score of 0.999601 signifies its discriminatory ability within SDN environments. Table 3 provides a comprehensive assessment of various ML techniques, including DNN, ELM, GB, and our novel OptMLP-CNN, in their capacity to detect DDoS activities across different datasets, namely NSL-KDD, UNSW_NB-15, CIC-IDS-2017, CICDDoS-2019, and InSDN. The findings reveal that all models, both the well-established benchmark models [9, 13, 24] and the proposed methods, exhibit a commendable performance across various evaluation metrics, including accuracy, precision, recall, and F1-score. Notably, the OptMLP-CNN model achieves the highest accuracy of 99.98% when employed with the InSDN dataset, underscoring its proficiency in accurately classifying network traffic. Precision, a crucial metric for minimizing false positives, is also notably high across all models. Among the benchmark models, model [13] exhibits the highest precision at 99.88%, while the proposed OptMLP-CNN model, when applied to the InSDN dataset, boasts the highest precision at 99.99%. This indicates the model's ability to minimize misclassifications of benign traffic as DDoS attacks. The recall metric, which measures the capacity to capture actual DDoS attacks effectively, is quite impressive across the benchmark models, ranging from 98.81% [9] to 99.99% [13]. Furthermore, the proposed OptMLP-CNN, when utilized with the CICDDoS-2019 dataset, demonstrates a recall of 99.98%, while it maintains a recall of 99.97% when applied to the InSDN dataset.