# Optimized MLP-CNN Model to Enhance Detecting DDoS Attacks in SDN Environment
## 4 Proposed Model
### OptMLP-CNN Detector
It strongly advocates continuous monitoring and iterative updates to ensure adaptability and performance refinement. The proposed CNN Architecture algorithm delineates the creation of a CNN model, paramount for image-based classification tasks (refer to Algorithm 2). Aligning with the MLP Architecture, the algorithm initiates data preprocessing, ensuring dataset normalization, augmentation, and formatting for the CNN model. The CNN architecture encompasses two convolutional layers, each paired with ReLU activation and same padding. Max-pooling layers augment these layers to reduce feature map dimensionality. Further components include a flattening layer and two fully connected layers, employing softmax for multiclass or sigmoid for binary classification in the last layer. ```
0: training data \(D_{\text{train}}\), testing data \(D_{\text{test}}\)
0: hyperparameters for MLP architecture
1: Preprocess the data: normalize, augment, and format the dataset
2: Build the MLP model:
3: Number of layers: 3
4: Units per layer:
5: Input layer: number of features in your data
6: Hidden layer 1: 128 units with ReLU activation
7: Hidden layer 2: 64 units with ReLU activation
8: Output layer: number of output classes with suitable activation function (e.g., softmax for multiclass or sigmoid for binary classification)
9: Compile the MLP model: define loss, optimizer, and evaluation metrics
10: Train the MLP model on \(D_{\text{train}}\) for a set number of epochs
11: Evaluate the model on \(D_{\text{test}}\) and calculate performance metrics
12: Fine tune hyperparameters as needed
13: Optionally deploy the model
14: Continuously monitor and update the model
```  
**Algorithm 1** Proposed MLP Architecture```
0: training data \(D_{\text{train}}\), testing data \(D_{\text{test}}\)
0: hyperparameters for CNN architecture
1: Preprocess the data: normalize, augment, and format the dataset
2: Build the CNN model:
3: Convolutional layer 1:
4: Number of filters: 32
5: Filter size: 3 \(\times\) 3
6: Activation function: ReLU
7: Padding: same
8: Max pooling layer 1:
9: Pool size: 2 \(\times\) 2
10: Convolutional layer 2:
11: Number of filters: 64
12: Filter size: 3 \(\times\) 3
13: Activation function: ReLU
14: Padding: same
15: Max pooling layer 2:
16: Pool size: 2 \(\times\) 2
17: Flatten layer: converts 2D feature maps to a 1D vector
18: Fully connected layer 1:
19: Number of units: 128
20: Activation function: ReLU
21: Fully connected layer 2 (output layer):
22: Number of units: number of classes
23: Activation function: softmax (for multiclass) or sigmoid (for binary classification)
24: Compile the CNN model: define loss, optimizer, and evaluation metrics
25: Train the CNN model on \(D_{\text{train}}\) for a set number of epochs
26: Evaluate the model on \(D_{\text{test}}\) and calculate performance metrics
27: Fine tune hyperparameters as needed
28: Optionally deploy the model
29: Continuously monitor and update the model
```

**Algorithm 2** Proposed CNN Architecture

The algorithm compiles the CNN model postconstruction, specifying crucial components like loss functions, optimizers, and evaluation metrics. Subsequent training on the provided dataset occurs over a defined number of epochs. Upon completion, the model undergoes rigorous evaluation on the testing dataset, where diverse performance metrics are computed. Similar to the MLP Architecture, provisions for hyperparameter tuning, optional deployment, and continuous model monitoring and updating are integrated into this CNN model. The combined MLP-CNN Detector, as detailed in Algorithm 3, merges the MLP and CNN architectures to optimize DDoS-attack detection. It integrates preprocessing for dataset refinement and employs SHAP for feature selection, which is crucial for identifying key DDoS-related features. This amalgamation paves the way for a robust combined MLP-CNN model that leverages MLP's structured data handling and CNN's image-analysis prowess. The algorithm initiates with meticulous data preprocessing, normalizing and enhancing the dataset, and SHAP-feature selection.