## 7 Conclusions  
In this work, the BDLSTM-autoencoder model, which combines deep neural network techniques with autoencoder-based feedforward neural networks, proved successful in terms of detecting DDoS attacks in an SDN environment. The deep stack auto-encoding model is constructed by stacking the input layer and hidden layer of self-encoding models' layer by layer. Each self-encoding model generates a hidden layer. After the flow table feature vector is learned by the first self-encoding model, the compressed abstract features are obtained in its hidden layer. Then, the hidden layer of the first self-encoding model becomes the input layer of the second self-encoding model. The learning of the second auto-encoding model obtains more abstract features after further compression in its hidden layer. Then, the auto-encoding model can be used to achieve the purpose of dimensionality reduction and abstract feature extraction when constructing the model. Two deep-learning models have been investigated, one based on multilayer convolutional neural networks (CNN) with Max pooling, and the second based on bidirectional long short-term memory (BDLSTM). In this article, two datasets that train and test DDoS attacks (ISCX-IDS-2012 and UNSW2018) were compared with related works. Additionally, the data generated make use of a Scapy script inside Mininet to create UDP packets and spoof the source IP address of the packets.  
The model-based BDLSTM-autoencoder achieved higher accuracy than the CNN model. Dataset splitting had no significant effect on detection accuracy, although a 60-20-20 training, testing, and validation split was relatively better. The activation function in the output layer highly affected both the stability and accuracy of detection, with sigmoid as the best choice for model success. The ISCX-IDS-2012 dataset accuracy reached a high of 99.35% in training, 99.3% in validation, and 99.99% in precision, recall, and F1-score. In addition, the UNSW2018 dataset accuracy reached a high of 99.95% in training, 0.99.94% in validation, and 99.99% in precision, recall, and F1-score for attacks and 99.5%, 99.4%, and 99.5% in precision, recall, and F1-score, respectively. Moreover, the model achieved great results with a dynamic dataset (using an emulator), reaching a high of 97.68% in accuracy. However, further exploration on the use of autoencoders with other deep-learning techniques is still necessary, as well as testing with different DDoS datasets.  
Conceptualization, A.L.Y. and H.M.M.; methodology, A.L.Y. and H.M.M.; formal analysis, A.L.Y. and M.H.; investigation, A.L.Y. and H.M.M.; writing--original draft preparation, A.L.Y. and M.H.; supervision, H.M.M. and M.H. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Data Availability Statement: Data are derived from public domain resources. The authors would like to thank Computer Science Department, Faculty of Computers and Information, Menoufia University, Shebin Elkom, Egypt and Department of Information Systems, College of Administration and Economics, University of Baghdad, Iraq. The authors declare no conflict of interest.