# Real-Time Detection of DDoS Attacks Based on Random Forest in SDN
## 4 Results and Discussion
\begin{table}
\begin{tabular}{c c c c c c} \hline
**Feature** & **Code** & **Feature** & **Code** & **Feature** & **Code** \\ \hline Source Port & 1 & Fwd IAT Min & 28 & Down/Up Ratio & 55 \\ Destination Port & 2 & Bwd IAT Total & 29 & Average Packet Size & 56 \\ Protocol & 3 & Bwd IAT Mean & 30 & Avg Fwd Segment Size & 57 \\ Timestamp & 4 & Bwd IAT Std & 31 & Avg Bwd Segment Size & 58 \\ Flow Duration & 5 & Bwd IAT Max & 32 & Fwd Header Length.1 & 59 \\ Total Fwd Packets & 6 & Bwd IAT Min & 33 & Fwd Avg Bytes/Bulk & 60 \\ Total Backward Packets & 7 & Fwd PSH Flags & 34 & Fwd Avg Packets/Bulk & 61 \\ Total Length of Fwd Packets & 8 & Bwd PSH Flags & 35 & Fwd Avg Bulk Rate & 62 \\ Total Length of Bwd Packets & 9 & Fwd URG Flags & 36 & Bwd Avg Bytes/Bulk & 63 \\ Fwd Packet Length Max & 10 & Bwd URG Flags & 37 & Bwd Avg Packets/Bulk & 64 \\ Fwd Packet Length Min & 11 & Fwd Header Length & 38 & Bwd Avg Bulk Rate & 65 \\ Fwd Packet Length Mean & 12 & Bwd Header Length & 39 & Subflow Fwd Packets & 66 \\ Fwd Packet Length Std & 13 & Fwd Packets/s & 40 & Subflow Fwd Bytes & 67 \\ Bwd Packet Length Max & 14 & Bwd Packets/s & 41 & Subflow Bwd Packets & 68 \\ Bwd Packet Length Min & 15 & Min Packet Length & 42 & Subflow Bwd Bytes & 69 \\ Bwd Packet Length Mean & 16 & Max Packet Length & 43 & Init\_Win\_bytes\_forward & 70 \\ Bwd Packet Length Std & 17 & Packet Length Mean & 44 & Init\_Win\_bytes\_backward & 71 \\ Flow Bytes/s & 18 & Packet Length Std & 45 & act\_data\_pk\_fwd & 72 \\ Flow Packets/s & 19 & Packet Length Variance & 46 & min\_seg\_size\_forward & 73 \\ Flow IAT Mean & 20 & FIN Flag Count & 47 & Active Mean & 74 \\ Flow IAT Std & 21 & SYN Flag Count & 48 & Active Std & 75 \\ Flow IAT Max & 22 & RST Flag Count & 49 & Active Max & 76 \\ Flow IAT Min & 23 & PSH Flag Count & 50 & Active Min & 77 \\ Fwd IAT Total & 24 & ACK Flag Count & 51 & Idle Mean & 78 \\ Fwd IAT Mean & 25 & URG Flag Count & 52 & Idle Std & 79 \\ Fwd IAT Std & 26 & CWE Flag Count & 53 & Idle Max & 80 \\ Fwd IAT Max & 27 & ECE Flag Count & 54 & Idle Min & 81 \\  & & & & Inbound & 82 \\ \hline \end{tabular}
\end{table} 
Table 3: The 82 features and codes. optimized by the optimization algorithm, and the test set size was 0.33 million. This is based on Table 6 and the corresponding Figures 9 and 10. Comparing the experimental results 1 and 2 shows that, after feature selection, although only 24 features were retained, Acc, Pre, Rec, F1, and Ave did not drop significantly, but the prediction time was reduced by 0.25414 s. The experiments show that the heterogeneously integrated feature selection algorithm can reduce the prediction time by reducing the number of features without reducing the prediction accuracy. Comparing experimental results 2 and 3, it can be seen that the RF optimization algorithm not only reduces the prediction time by 0.016999 s but also improves Acc, Pre, Rec, F1, Ave by 0.084796, 0.0  
Figure 11: Confusion matrix comparison of experimental results. Figure 12: ROC curves and AUC values for Experiment 3 (YFS-YRF). Figure 10: Time for prediction of experimental results. In a cluster of SDN controllers, when each controller has the same residual weight and the amount of data to be processed is 231,000, the experimental results are shown in Table 7 and Figure 13. As the number of SDN controllers increases, the number of processing tasks for a single controller decreases, and with it, the processing time for the total dataset decreases. The experiments demonstrate the ability of the residual weight random polling algorithm to reduce the processing time of the total tasks using distributed devices.