# Comparative Study of AI-Enabled DDoS Detection Technologies in SDN
## 4 Experiment Analysis and Verification  
### Experimental Results  
In order to obtain the high-priority features that have a high impact on the prediction, the feature selection method permutation importance was applied. The normal traffic data and DDoS attack data were analyzed on our SDN architecture with a total dataset of 12,794,627 samples. The training dataset used comprised 7,676,776 samples, which was 60% of the total dataset. In testing, 5,117,851 samples (40% of the total dataset) were used. The reduced features obtained by the feature selection were applied to our classifier models and the parameters were the same as those used in our previous study. As the reduced feature set, 64, 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5 and 4, respectively, were selected as per the given classifier model. The features were trained by the classifier algorithm based on the RF, NB, DT, CNN and RNN models. The obtained results are presented in Table 3. The parameters used to analyze the traffic are the evaluation time, accuracy, sensitivity, precision and F1_Score. The F_Score is the weighted average of the precision and sensitivity. Finally, the specificity is the ability to assess unequivocally the analysis in the presence of components. The results obtained show that if we reduce the features, we cannot guarantee a performance increase in parameters such as accuracy, sensitivity, precision, specificity and the F1_Score; however, the evaluation is strengthened by reducing the features. To summarize the results obtained, we can state that obtaining the best features that have a strong impact on the detection of DDoS attacks can enhance the performance. The results of our DDoS detection model based on the random forest model, using five feature sets and the permutation importance algorithm, show 99.976% accuracy and F1_Score values. In the second part of study, we analyzed each model's performance to briefly provide the results of individual models with different features selected from the dataset. We started from 64 feature sets and then, according to the classifier model, features were selected that ranged from 15 to 4. The classifier models based on machine learning and deep learning both had their own impacts on the results. The results of the individual classifier models are shown in Tables 4, 5, 6, 7 and 8, respectively. The obtained results from the different classifier models with different feature sets are quite interesting. Every classifier model's result shows the importance of selecting features. As we can see in Table 2, random forest performs better with five features in detecting and mitigating DDoS attacks in the SDN \begin{table}
\begin{tabular}{l l l l l l l l} \hline \hline
**Model** & **Features** & **Evaluation Time** & **Accuracy** & **Sensibility** & **Precision** & **Specificity** & **F1\_Score** \\ \hline Random Forest & 5 & 5.09 s & 99.976\% & 99.974\% & 99.978\% & 99.978\% & 99.976\% \\ Decision Tree & 7 & 0.44 s & 99.842\% & 99.829\% & 99.852\% & 99.856\% & 99.840\% \\ Naive Bayes & 8 & 0.69 s & 93.645\% & 96.293\% & 91.317\% & 91.059\% & 93.739\% \\ CNN & 13 & 4.13 s & 96.654\% & 94.412\% & 98.760\% & 98.843\% & 96.537\% \\ RNN & 15 & 4.28 s & 98.723\% & 98.200\% & 99.207\% & 99.234\% & 98.701\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Performance comparison of the machine learning and deep learning models. environment. The individual results show that machine learning-based models perform better than deep learning models. The decision tree and random forest results surpass those of other classifier models with different feature sets. The deep learning-based model's highest accuracy and F1_Score are 98.723% and 98.70% with the RNN, and the results with the CNN model are 96.654% and 96.537%, respectively. However, the machine learning-based random forest and decision tree models have over a 99% accuracy rate and over a 99% F1_Score.