## 5 Material and Methods
### Network Traffic Data Collection
#### 5.5.1 Traffic Feature Collection via OpenFlow  
In the OpenFlow-based approach, the control plane (SDN controller) queries the data plane devices (OpenFlow switches) for traffic statistics at regular intervals \(T_{f}\). Let there be \(N\) switches, denoted by \(S_{i}\) where \(i=1,2,\ldots,\ N\). \begin{table}
\begin{tabular}{l l l} \hline \hline
**timestamp** & **datapath\_id** & **flow\_id** \\ \hline ip\_src & tp\_src & ip\_dst \\ \hline tp\_dst & ip\_proto & icmp\_code \\ \hline icmp\_type & flow\_duration\_sec & flow\_duration\_nsec \\ \hline idle\_timeout & hard\_timeout & flags \\ \hline packet\_count & byte\_count & packet\_count\_per\_second \\ \hline packet\_count\_per\_nsecond & byte\_count\_per\_second & byte\_count\_per\_nsecond \\ \hline \hline \end{tabular} Class: Traffic class. The data in the dataset used in this study are labeled data. These two classes are “0” and “1”. “0” represents data received during normal traffic flow, and ’1’ represents data received during a DDoS attack.  
\end{table} 
Table 1: The features in the dataset. At each time step \(t\), the SDN controller sends a flow statistics request, \(R_{f}(t)\), to each switch \(S_{i}\) to retrieve up-to-date traffic information. This request is structured as (Equation (1)):  
\[R_{f}(t)=\{\text{OFPC\_FLOW\_STATS\_REQUIST}\}\ \forall i=1,2,\ldots,N \tag{1}\]  
In Equation (1):  
\(R_{f}(t)\): represents the flow statistics request made by the controller to each switch \(S_{i}\) at time \(t\). OFPC_FLOW_STATS_REQUIST: a specific OpenFlow command that queries switches for flow statistics, ensuring the controller obtains information about each flow passing through the switches. The notation \(\forall i=1,2,\ldots,N\): indicates that this request is made to all switches in the network, where N is the total number of switches in the system. Each switch \(S_{i}\) responds with a flow statistic reply \(R_{f\_reply}(t)\), which contains traffic features \(F_{i}(t)\) for each flow at time \(t\). These features include packet counts, byte counts, and flow durations, among others. Mathematically, this can be expressed as:  
\[R_{f\_reply}(t)=\{\text{OFPC\_FLOW\_STATS\_REPLY}|F_{i}(t)\} \tag{2}\]  
where the feature set  
\[F_{i}(t)=\{\text{timestamp},\text{datapath\_id},\text{flow\_id},\text{ip\_src}, \text{ip\_dst},\text{tp\_src},\text{tp\_dst},\text{ip\_proto},\text{packet\_ count},\text{byte\_count},\ldots\} \tag{3}\]  
Equation (3) represents the traffic features collected from a switch. Traffic features from each switch are recorded at specific time intervals and are used to analyze network traffic. This set of traffic features is defined as \(F_{i}(t)\), and includes the following components: timestamp: The timestamp when the traffic feature was collected. datapath_id: The unique identifier of the switch. flow_id: The unique identifier for each flow. ip_src, ip_dst: Source and destination IP addresses. tp_src, tp_dst: Source and destination transport protocol port numbers. ip_proto: IP protocol number (e.g., TCP, UDP). packet_count: The total packet count for a specific flow. byte_count: The total byte count for a specific flow. These traffic features are recorded for all flows collected from a switch at a specific time and are expressed as shown in Equation (3). Each switch sends its flow statistics to the controller, which aggregates these responses over all switches \(i=1,2,\ldots N\). The combined feature set for all switches at time \(t\) is denoted as:  
\[F_{all}(t)=\bigcup_{i=1}^{N}F_{i}(t) \tag{4}\]  
Equation (4) represents the aggregated traffic features collected from all switches. Since there are multiple switches \(S_{i}\) in the system, the traffic features from each switch are collected as \(F_{i}(t)\). To compile traffic features from all switches at time step \(t\), a cumulative feature set \(F_{all}(t)\) is used in Equation (4). Where  
* \(F_{i}(t)\): Traffic features collected from the \(i\)-th switch at time t (e.g., packet count, byte count, etc.)