# Comparative Study of AI-Enabled DDoS Detection Technologies in SDN
## 4 Experiment Analysis and Verification
### Experimental Results
\begin{table}
\begin{tabular}{l l l l l l l} \hline \hline \multirow{2}{*}{**Feature Set**} & \multicolumn{2}{c}{**Evaluation**} & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**Sensibility**} & \multirow{2}{*}{**Precision**} & \multirow{2}{*}{**Specificity**} & \multirow{2}{*}{**F1\_Score**} \\  & & & & & & & \\ \hline
64 & 7.85 s & 99.979\% & 99.978\% & 99.980\% & 99.980\% & 99.979\% \\
12 & 0.89 s & 93.637\% & 96.300\% & 91.297\% & 91.036\% & 93.732\% \\
11 & 0.88 s & 93.645\% & 96.293\% & 91.317\% & 91.059\% & 93.739\% \\
10 & 0.82 s & 93.645\% & 96.293\% & 91.317\% & 91.059\% & 93.739\% \\
9 & 0.71 s & 93.645\% & 96.293\% & 91.317\% & 91.059\% & 93.739\% \\
8 & 0.69 s & 93.645\% & 96.293\% & 91.317\% & 91.059\% & 93.739\% \\
7 & 0.59 s & 92.108\% & 93.124\% & 91.100\% & 91.117\% & 92.101\% \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Performance of the naive Bayes (NB) model with permutation importance algorithm. \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline \multirow{2}{*}{**Feature Set**} & \multicolumn{2}{c}{**Evaluation**} & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**Sensibility**} & \multirow{2}{*}{**Precision**} & \multirow{2}{*}{**Specificity**} & \multirow{2}{*}{**F1\_Score**} \\  & & & & & & & \\
64 & 7.85 s & 99.979\% & 99.978\% & 99.980\% & 99.980\% & 99.979\% \\
12 & 5.66 s & 99.986\% & 99.985\% & 99.986\% & 99.987\% & 99.986\% \\
11 & 5.57 s & 99.986\% & 99.985\% & 91.986\% & 99.987\% & 99.986\% \\
10 & 5.07 s & 99.985\% & 99.984\% & 98.986\% & 98.986\% & 99.985\% \\
9 & 5.07 s & 99.978\% & 99.977\% & 99.978\% & 99.979\% & 99.978\% \\
8 & 4.88 s & 99.976\% & 99.975\% & 99.977\% & 99.978\% & 99.976\% \\
7 & 4.94 s & 99.976\% & 99.975\% & 99.977\% & 99.978\% & 99.976\% \\
6 & 5.09 s & 99.977\% & 99.975\% & 99.978\% & 99.978\% & 99.976\% \\
5 & 5.09 s & 99.976\% & 99.974\% & 99.978\% & 99.978\% & 99.976\% \\
4 & 4.59 s & 99.908\% & 99.862\% & 99.952\% & 99.953\% & 99.907\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Performance of the random forest (RF) model with permutation importance algorithm. \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline \multirow{2}{*}{**Feature Set**} & \multicolumn{2}{c}{**Evaluation**} & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**Sensibility**} & \multirow{2}{*}{**Precision**} & \multirow{2}{*}{**Specificity**} & \multirow{2}{*}{**F1\_Score**} \\  & & & & & & & \\
64 & 1.61 s & 99.984\% & 99.982\% & 99.985\% & 99.985\% & 99.984\% \\
12 & 0.49 s & 99.983\% & 99.981\% & 99.985\% & 99.988\% & 99.983\% \\
11 & 0.50 s & 99.853\% & 99.841\% & 99.862\% & 99.865\% & 99.852\% \\
10 & 0. In the third part of study, we compared the performance of our models on the basis of the detection time of attacks. In this study, we analyzed the shortest time taken by our classifier models to detect DDoS attacks in the SDN environment. The graph is presented in Figure 4. The results shows that the decision tree model has the shortest time taken to detect the DDoS attack, followed by the naive Bayes. The random forest shows the longest time taken for DDoS attack detection. In the fourth part of study, the accuracy and F1_Score were compared to analyze the performance of individual classifiers. The graph is presented in Figure 5. The graph shows the results after using the classifier models. The accuracy and F1_Score are the most important parameters in detecting and mitigating DDoS attacks. The results indicate that the highest accuracy and F1_Score are obtained by the random forest and decision tree models. The CNN and RNN models' performance is lower than that of the the machine learning-based models, except the naive Bayes model. The random forest and decision tree models achieve the accuracy and F1_Score values above 99%. The performance of both models shows how useful they both can be in detecting and mitigating DDoS attacks in SDN.