## 5 Vulnerabilities of SDN to LDDoS Attacks
### Classification-Based LDDoS Detection
#### 6.1.2 Limitations of Classification-Based Methods for Detecting LDDoS Attacks  
This section will present some of the challenges and limitations in classification-based LDDoS attack detection methods. Table 4 represents a summary of analysis methods used by existing work and their shortcomings or disadvantages. In [81], the authors presented a protection mechanism based on the dynamic deletion of flow rules. They applied the mechanism of LDDoS attacks to the SDN data layer to increase the detection accuracy and provide multiple functions based on FM. Although the proposed mechanism has acceptable accuracy (95%) in detecting an LDDoS attack, it was derived from a small network simulation (four switches and nine hosts). Although the model targets the data layer, it does not consider the synchronization process at the data layer and the scenario of connecting to more than one SDN controller. Therefore, the proposed model may fail in large-scale networks where more than one SDN controller is deployed in the absence of a mechanism based on synchronization between SDN controllers and data layer devices. In [76], the authors proposed Q-MIND to detect LDDoS attacks using a reinforcement learning technique based on Q-learning. Throughout the training phase, the authors require a collection of labeled traffic data that includes both anomalous and benign samples. These characteristics are calculated for each source IP address using a traffic dataset with 4000 regular traffic samples and 4000 attack samples. As a result, the Q-learning agent must train the detection engine and conduct validation tests. They design an optimization problem to find the best policies in scenarios where the immediate reward increases in each loop, using Q-learning to solve it. However, compared to similar models, the cost of this method for implementation and training is very high. In [17; 78], the authors have used various machine learning techniques to detect and identify LDDoS attacks and have indeed achieved high accuracy. Nevertheless, these methods can increase controller overhead and decrease response efficiency when used on an extensive network. Analyzing the work [77], where the authors developed an SDN framework based on machine learning to identify and mitigate LDDoS attacks. They utilized two aspects of the system (traffic collecting and flow table delivery). They used the SVM algorithm and traffic characteristics obtained from statistical flow table data to identify the attack traffic. However, the method identification process of determining the feature obtained from the flow table allows the SDN controller to write effective new rules to prevent LDDoS attacks is not addressed, which is essential for efficiency and network connectivity. In [79], the authors proposed DIAMOND as a structured coevolutionfeature optimization method to detect LDDoS for SDN enabled IoT networks. They used the group structuring method, counting strategy, and the intersection strategy to sort the count. The authors presented the method's shortcomings, as it does not provide a solution for forming sub-populations that build the individuals into a hierarchical tree. Moreover, the excessive load on OpenFlow switches by querying statistical data from flow entries increases switching overhead and decreases responsiveness to regular traffic. In [83], the authors proposed a detection and mitigation framework for LDoS attacks in SDN. The performance and features framework considers both attack performance and attacks flow features for LDoS attack detection decision. They performed a joint detection approach based on two aspects and implemented a real-time mitigation system to defend against LDoS attacks based on an SDN controller. However, the authors testify that feature classification and selection still need improvement. In addition, the framework forces the controller not to install new rules for the upcoming traffic during LDoS attacks, which results in the legitimate user experiencing more delays when the network is attacked.