# Optimized MLP-CNN Model to Enhance Detecting DDoS Attacks in SDN Environment
## 4 Proposed Model
### OptMLP-CNN Detector
This preparatory phase primes the data for modeling. The heart of the algorithm lies in merging the MLP and CNN architectures to craft a powerful model adept at decoding complex patterns associated with DDoS attacks. Subsequent steps entail model compilation, defining loss functions and metrics, and rigorous training. This training phase refines the model's parameters, improving its recognition of DDoS indicators. Post-training, the model undergoes a thorough evaluation by using a separate dataset and employs Bayesian optimization to fine tune hyperparameters, enhancing precision in identifying and mitigating DDoS attacks. The algorithm's adaptive nature includes provisions for model deployment in DDoS-detection systems, advocating continuous monitoring and updates to counter evolving threats effectively. It highlights the implementation of alert mechanisms for detected attacks, ensuring swift responses, and emphasizes meticulous documentation for comprehensive records of the model's architecture and training processes. ## 5 Experimental Results

In this section, we provide a detailed evaluation of the proposed model. We begin by outlining the experimental setup and introducing the evaluation metrics employed to assess the model's performance. Subsequently, the model's performance is examined under various scenarios, including exploring different activation functions and input-weight ranges. To gauge the effectiveness of our model, we compare the results with those of recent state-of-the-art methods. The experiments were conducted by using a Jupyter Notebook with Python, leveraging libraries such as scikit-learn, Pandas, and Matplotlib. The computational environment featured a 2.60 GHz Intel Core i7 10G processor, 4 GB NVidia GTX 1650 Ti graphics, 16 GB of RAM, and the Windows operating system. This rigorous evaluation validates our proposed model's robustness and effectiveness. ### Dataset

In our study, we harnessed two datasets: InSDN [36] and CICDDoS-2019 [37]. The CICDDoS-2019 dataset [37] provides a contemporary repository of DDoS-attack traces that manifest at the application layer, employing TCP/UDP-based protocols. This dataset classifies DDoS attacks into two distinct categories: reflection based and exploitation based. Reflection-based attacks involve using a reflector server to redirect malicious traffic towards the target, masking the source IP address. In contrast, exploitation-based attacks directly target the victim without needing a reflector server. The CICDDoS-2019 dataset encompasses a rich feature set comprising 88 distinct features. The InSDN dataset, as detailed by the authors of [36], aligns its focus with SDN infrastructures. This dataset was meticulously curated by deploying four virtual machines and incorporating a broad spectrum of attack classes from the SDN network's internal and external sources. It also includes a diverse representation of normal traffic, reflecting numerous application services. The InSDN dataset encompasses a substantial collection of 361,317 instances, including 68,424 benign or normal traffic and 292,893 instances of attack traffic. The dataset comprises 84 features that serve as the foundation for our research endeavors. ### Performance Metrics

Evaluating the effectiveness and accuracy of the DDoS-detection model is paramount. The literature consistently employs a set of well-established evaluation metrics based on four fundamental elements: true positive (TP), false positive (FP), true negative (TN), and false negative (FN). Accuracy: This widely used metric provides a holistic assessment of the classifier's correctness. It is calculated by dividing the total number of correct predictions by the total number of predictions made. The accuracy is computed as

\[Accuracy=\frac{TP+TN}{TP+FP+TN+FN} \tag{20}\]

Precision: Precision measures the proportion of true positive predictions out of all positive forecasts. It is defined as

\[Precision=\frac{TP}{TP+FP} \tag{21}\]

Recall: Recall quantifies the percentage of actual positive events correctly predicted.