# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 5 Available Benchmarked DDoS Datasets and Classes of Attacks in Datasets
\begin{table}
\begin{tabular}{p{14.2 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Reference** & **Methodologies** & **Strengths** & **Weaknesses** \\ \hline [PERSON] et al. [75] & A five-layered AE model was developed for efficient unsupervised DDoS detection & AE-D3F achieved nearly 100\% DR with less than 0.5\% FPR, although the RE threshold value must be specified. This method compensates for the lack of labeled attack data by training the model using only regular traffic & Used an outdated dataset \\ \hline [PERSON] et al. [76] & Suggested a hybrid AE-SVM technique & In terms of quick anomaly identification and low false-positive rate, the AE-SVM method fared better than other approaches & Compared to the other two datasets, the suggested model’s accuracy on the NSL-KDD dataset was lower & Compared to the other two datasets, the suggested model’s accuracy on the NSL-KDD dataset was lower \\ \hline [PERSON] et al. [77] & Combined a stacked sparse AE to learn features with a DNN for categorizing network data & The results indicated an accuracy of 98.92\%. The suggested approach worked well to address issues with feature learning and overfitting, as the AE was trained with random training data samples to perform feature learning and overfitting was avoided by employing the sparsity parameter & Performed an offline study rather than evaluating the most recent datasets. Additionally, the suggested model could not compute the detection time. \\ \hline [PERSON] et al. [41] & Combined the LSTM and Bayes techniques & The results revealed that, the performance indicators decreased only slightly with the new data, and the outcomes were positive & Essentially that are unsuited for real-time applications may take the LSTM-BA longer to identify. Comparing the suggested model to the current DeepDefense approach, the accuracy was only improved by 0.16\%. IP addresses were transformed into actual vectors using feature hashing, and the preprocessing time was not computed using the BOW. \\ \hline [PERSON] et al. [39] & Employed multi-objective optimization, namely, the NSGA approach & F1-score value of 99.36\% and high accuracy of 99.03\%. Additionally, The outcomes demonstrated that the suggested model outperformed earlier studies. When compared to previous DL approaches, the training time was cut by an astounding eleven times & The majority of the cutting-edge methods used in this article did not use the CICIDS2017 dataset; therefore, the analogy appears inappropriate. \\ \hline [PERSON] et al. [42] & Combined AE and RNN to produce DDoS-Net for identifying DDoS assaults in SDNs & The results indicated that DDoS-Net performed better than six traditional ML techniques (DT, NB, RF, SVM, Booster, and LR) in terms of accuracy, recall, precision, and F1-score. The proposed method obtained 99\% accuracy and an AUC of 98.8 & The dataset used offline analysis \\ \hline [PERSON] et al. [40] & A DL-based strategy was proposed to identify sluggish DDoS assaults in SDNs using a CNN–LSTM model & The results indicated that DDoS-Net performed better than four other approaches, obtaining more than 99.5 percent across all performance criteria & The dataset used offline analysis \\ \hline [PERSON] et al. [78] & A strategy based on DTL was proposed to identify DDoS attacks & A 20.8\% improvement was achieved on detection of the SLRANN network in the target domain. The DTN technique with fine-tuning avoided the decline in detection performance & For model evaluation, only one attack is used in both the source domain and the target domain. \\ \hline [PERSON] et al. [79] & Suggested a minimax gradient-based deep reinforcement learning technique & When compared to cutting-edge algorithms, the suggested policy-based GFDS algorithm outperformed them in terms of anti-jamming performance & The dataset used offline analysis \\ \hline \hline \end{tabular}
\end{table}