# Comparative Study of AI-Enabled DDoS Detection Technologies in SDN
## 2 Research Background and Motivations  
### Background  
Software-defined networking has simplified network management and provides the easiest way to manage the network infrastructure through the SDN controller and programmable switches. However, SDN has some major issues and researchers are continually trying to overcome them. We discuss briefly the issues related to SDN DDoS detection in the following subsections. The main component of SDN is a controller, which controls the whole infrastructure of the network and provides simplified network management. There are three layers in an SDN architecture: firstly, the application layer, which provides a facility for the network to interact with applications; secondly, the control plane layer, which is considered as the brain of SDN because it controls the network flow; lastly, the infrastructure layer, which is responsible for traffic forwarding. A preliminary step that takes place before the actual packet forwarding in an SDN network includes the discovery of the topology [5]. The SDN controller keeps the updated information related to the data plane using the OpenFlow discovery protocol, while all other network devices using the Link Layer Discovery Protocol advertise their identities and neighbors in the network.  
In [6], the authors state that \"a DDoS is an attack on a server where a massive number of packets are sent to create an outage or service degradation for legitimate user\". According to [7], the attacker's main focus is resource consumption and bandwidth reduction. Thus, the detection of these attacks is necessary to protect the network. The attacker has two main targets: controllers and network elements. To protect the network from DDoS attacks, we must monitor and analyze the network traffic to identify malicious traffic. The detection of DDoS attacks is very complicated because malicious traffic appears as normal traffic. Even if we identify the attack traffic, we cannot block the attacker's IP due to IP spoofing. When the SDN suffers from DDoS attacks, the switch eventually loses its connection to the controller. It will look for another controller if there is a standby controller available and then it will connect with it [8; 9; 10]. In terms of time-based techniques, the time characteristics are an important factor in attacks such as DDoS. The authors of [11] proposed a technique that uses the time duration to detect DDoS attacks and uses the time pattern to prevent attacks in the future. Such solutions are not sufficient to respond to the current attacks. A small window and short-term statistic can be used in an SDN network, as in [12], which proposed an entropy-based DDoS detection scheme that was used in a non-SDN network. This method uses the randomness to calculate the number of incoming packets to specific hosts [13] and then it compares this to a threshold value. The detection is based on a comparison of the results. In [14], the authors proposed an entropy-based technique to detect DDoS attacks, but there is no solution to mitigate them in the future. There is a need for some intelligent algorithms to detect these attacks.  
Table 1 shows the recent research methods applied in detecting DDoS attacks and the advantages and disadvantages of each.