## 6 Performance Evaluation of the SD-VANET_GUARD DDoS Attack Detection System
Based on this mechanism, the attack detection system successfully identified the DDoS attack in the SD-VANET network at 17:57:30, as shown in Figure 9. Approximately 90% of the existing flows in the network consisted of DDoS traffic. The detection mechanism demonstrated its capability to distinguish between attack traffic and normal network traffic within the SD-VANET environment. The test results revealed that the 1 DCNN-DT hybrid model achieved high classification accuracy and that the proposed SD-VANET_Guard defense system operated effectively as a DDoS detection tool. SD-VANET networks present a unique environment for traffic flow due to several inherent characteristics, including high vehicle mobility, frequent and unpredictable topol  
Figure 8: CPU utilization of the controller in the experimental SD-VANET topology. Figure 9: Percentage of DDoS traffic in the existing network flow within the experimental SD-VANET topology. ogy changes, and dynamic network density. These factors create distinct patterns in traffic flows that differ from those observed in more stable, traditional networks. In a typical DDoS attack on a conventional network, attack traffic often overwhelms the target by saturating available bandwidth and exploiting vulnerabilities in a relatively stable network structure. However, in SD-VANET, the variability of traffic flow, rapid vehicle movement, and frequent changes in connection points introduce additional complexities that shape the nature of DDoS traffic. During DDoS attacks in an SD-VANET environment, traffic flows experience unique disruptions due to the highly mobile nature of the network. For example, as vehicles frequently enter and exit the communication range of Roadside Units (RSUs) and other network nodes, the attack traffic exhibits irregular bursts, creating a sporadic, less predictable pattern compared to attacks on static networks. This leads to high packet loss and temporary link failures, which in turn generate rapid changes in traffic density and the distribution of packet flows. Consequently, DDoS attacks in SD-VANET are marked by short, intense spikes in packet transmission followed by rapid declines, as opposed to the more sustained traffic saturation seen in traditional networks. Our hybrid detection model leverages the 1D-CNN to capture these unique variations in SD-VANET traffic data, focusing on features such as fluctuating packet arrival rates, intermittent surges, and distinctive flow patterns that occur as vehicles move in and out of range. The 1D-CNN component is particularly suited for SD-VANET's dynamic context, as it can extract and analyze subtle temporal features from traffic data that correspond to the irregular flow changes caused by high mobility. For instance, when a vehicle under attack transitions out of the RSU's coverage, the CNN detects the resulting drop in packet reception, while the Decision Tree classifier interprets this as part of the DDoS signature unique to SD-VANET. Furthermore, SD-VANET networks often experience variable traffic densities, with high concentrations of vehicles in urban areas and lower densities in rural zones. This variability affects the detection of DDoS attacks, as the density changes influence the volume and flow of both legitimate and malicious traffic. Our model is trained to recognize these density-related fluctuations, allowing it to distinguish between natural traffic flow changes and malicious surges that indicate a DDoS event. Unlike conventional DDoS attacks where traffic overload remains consistent, DDoS in SD-VANET generates traffic spikes that coincide with high-density vehicular clusters, making it essential for the detection model to differentiate between these natural and attack-induced anomalies. The Decision Tree classifier contributes by processing these complex flow patterns quickly, helping to classify high-density traffic surges more effectively in real-time.