# Optimized MLP-CNN Model to Enhance Detecting DDoS Attacks in SDN Environment
## 3 Background
### Feature Selection  
Feature selection is an important step in DDoS-attack detection, primarily due to the often high dimensionality of network data. This process is instrumental in improving the performance and interpretability of ML models by selecting a subset of the most essential features. The significance of feature selection arises from its ability to address various challenges within DDoS detection. High dimensionality can lead to computational inefficiencies and overfitting while including irrelevant or noisy features can obfuscate the model's decision-making process. Therefore, feature selection aims to mitigate these challenges by reducing dimensionality, eliminating noise, and enhancing interpretability. Feature-selection methods encompass three main categories: filter methods, which independently evaluate feature relevance; wrapper methods, which involve the ML classifier in exploring feature subsets; and embedded methods, which seamlessly integrate feature selection with the ML algorithm. The feature-selection method should be tailored to the dataset's characteristics, available computational resources, and the specific ML model in use, as it significantly impacts the effectiveness of DDoS-attack detection, particularly within SDN environments [3, 4].  
SHAP-feature selection represents a cutting-edge technique for assessing the significance of individual features within a dataset while constructing predictive models. Rooted in the principles of cooperative game theory, SHAP assigns a numerical value to each feature, quantifying its impact on model predictions by meticulously considering every possible combination of features. A higher SHAP value for a particular feature signifies its heightened influence on shaping the model's predictive outcomes. Armed with this knowledge, data scientists can meticulously rank features according to their SHAP values, enabling them to pinpoint the most essential attributes for model precision and inter pretability. This process facilitates strategically selecting a subset of the most informative features, streamlining the model-development process and elevating the overall predictive performance to new heights [4,13].  
The Shapley value, formally defining the SHAP value for cooperative games, is calculated by summing the worth of all potential coalitions that do not include a specific player, denoted as \(i\), and subtracting the value of coalitions that exclude this player, as mentioned in [4]. This calculation is divided by the total number of players, essentially quantifying the individual player's contribution to the coalition. The formula for the Shapley value is expressed as  
\[\varphi i(v)=\frac{1}{n}\sum S\subseteq N\setminus i\big{[}n-1\mid S\big{]} \big{]}^{-1}(v(S\cup i)-v(S)) \tag{1}\]  
In this equation, \(\mid S\mid\) represents the size of the coalition, and \(N\) stands for the total number of players involved. The summation encompasses all feasible coalitions that exclude player \(i\). Furthermore, \(v(S)\) denotes the value attributed to the coalition \(S\).  
The Shapley value introduces two important concepts, namely \"dummy\" and \"efficiency\", which are described by Equations (2) and (3). In cooperative games, a player who contributes nothing to the final outcome and is essentially ignored in the Shapley value calculation is referred to as a \"dummy\" player. The principle of efficiency ensures that the summation of Shapley values for all players equals the total outcome of the game:  
\[v(S\cup x_{n})=v(S), \tag{2}\]  
\[for\ all\ S\subseteq\{x_{1},\ldots,x_{m}\},\ then\ \varphi_{n}=0\]  
\[\sum_{i\in N}\varphi_{i}(v)=v(N) \tag{3}\]