## 4 Experimental Result
### Results  
This section presents the analysis of the proposed approach's performance in improving the DR and reducing the FPR for detecting low- and high-rate DDoS attacks on the controller, targeting single or multiple victims. The proposed approach's performance was evaluated using eight simulation scenarios with varying attack traffic rates to measure the average DR and FPR. The proposed approach yielded the following results for low- and high-rate DDoS attack scenarios. Figure 4 shows the proposed approach's DR and FPR in detecting low-rate DDoS attacks. In this scenario, a single host or multiple hosts launch DDoS attacks on the SDN controllers regardless of the number of targets, with a low attack traffic ratio of up to 7 % and 19 %, respectively. In addition, the host acting as the attacker generates packets with unique spoofed IP addresses to trigger low-rate DDoS attacks. Since the switch's flow table does not yet have any record of these source IP addresses, the packets will be forwarded to the controller for further processing and action. \begin{table}
\begin{tabular}{c c} \hline \hline
**Metric** & **Description** \\ \hline True Positive (TP) & The data instance is correctly predicted as an attack by the classifier. \\ \hline False Negative (FN) & The data instance is wrongly predicted as a normal instance. \\ \hline False Positive (FP) & The data instance is wrongly classified as an attack. \\ \hline True Negative (TN) & The instance is correctly classified as a normal instance. \\ \hline Detection Rate (DR) & Calculated as the percentage of the correctly detected DDoS attack to the summation of the total number of attacks. \\ \hline \hline \end{tabular} The equations used to calculate DR and FPR are as follows: detection rate (DR) = TP/TP + FN; false positive rate (FPR) = FP/FP + TN.  
\end{table} 
Table 4: Description of confusion matrix attributes. Figure 4: Average DR and FPR of each low-rate DDoS attack traffic scenarios. Although the DDoS attack traffic rate is low (0.2/s) and similar to normal traffic, the proposed approach's DR ranges between 95.11 % to 96.98 %, which means the proposed approach can accurately detect low-rate DDoS attacks against the controller. Meanwhile, the FPRs range from 3.02% to 4.90%. The detection effectiveness is due to the dynamic threshold that changes its value according to the varying network traffic rates within \(t\) time. Meanwhile, Figure 5 shows the proposed approach's DR and FPR in detecting high-rate DDoS attacks. In this scenario, a single host or multiple hosts launch DDoS attacks on the SDN controllers regardless of the number of targets, with a high attack traffic ratio of up to 34 to 62%. In addition, the host acting as the attacker generates spoofed IP packets with unique IP addresses to trigger high-rate DDoS attacks. Figure 5 shows the proposed approach's DDoS attack detection ratios at 34%, and 62% of the high attack traffic rates range between 99.03% to 97.03%, which means the proposed approach can accurately detect high-rate DDoS attacks on the SDN controller. Meanwhile, the FPR range is between 0.97% to 2.97% for high-rate DDoS attack scenarios. Meanwhile, the proposed approach's performance was compared with two existing approaches dependent on the entropy algorithm [28], the fusion entropy algorithm [32], and information theory [34]. Since the entropy technique is the basis for all entropy-based methods, those approaches share the same common limitations. For instance, the reliance on a fixed threshold to detect different DDoS attack traffic rates targeting single or multiple hosts makes it challenging to detect low-rate DDoS attacks with a high DR and low FPR. In this study, the comparison uses eight attack simulation scenarios and two evaluation metrics, DR and FPR. The rest of this section first discusses the performance of the approaches [28; 32; 34] in detecting low and high DDoS attack traffic rates, regardless of whether the target is a single or multiple victims, then compares the results with the proposed approach.