## 5 Vulnerabilities of SDN to LDDoS Attacks
### Classification-Based LDDoS Detection  
Classifying algorithms are frequently used as classifiers to identify LDDoS attacks in SDN for LDDoS detection. According to our findings, SVM, Random Tree, J48, REP Tree, MLP, SVM, and RF are the most often utilized classification algorithms in SDN for identifying LDDoS attacks. An LDDoS Detection framework based on classification may be placed at a crucial node of an SDN, such as the SDN controller or the OpenFlow switch [105]. The framework consists of four main stages, as shown in Figure 6: data collection, feature extraction, classification model, and output. In the first stage, data collection consists of packet capturing, packet filtering, and dataset preprocessing steps. In the second stage, the feature selection and selection policy will be generated based on the previous stage; the feature value can be divided into stateless and stateful. In the third stage, the model is trained for the classification process to detect an LDDoS attack using several binary classification methods such as RF, SVM, J48, and test datasets. In the final stage, the user decision is made based on user-defined feedback, which is continuously taken to support periodic learning and testing of the model prediction process, correlation, and recognition of LDDoS attacks from regular traffic. In [81], [PERSON] et al. presented a protection mechanism based on dynamic flow rule deletion. They investigate the mechanism of LDDoS attacks on the SDN data layer to increase detection accuracy and then offer a multi-feature LDDoS attack detection method based on Factorization Machine (FM). The authors employ AUC (area under the curve) [106] as the primary metric of recognition performance, with recall rate, accuracy, and precision as supplementary indicators, to assess the impact of machine learning classification FM. The samples were separated into two groups: one for anomalous traffic and the other for regular traffic. The indicators were developed using the number of true/false positive  
Figure 6: Architecture of machine learning-based classification for LDDoS attack detection frameworks for SDN. and true/false negative groups. The dwell time is gathered and computed when the window function's size is set to 20 s; the number of packets, RDMB, and RDPI to save every flow rule in the flow table by the window function; and the variance of the dwell time are calculated. To define the difference between attack and regular traffic, the data were identified based on the attacked port, and a total of 140,000 feature datasets were obtained. A total of 100,000 feature datasets were chosen as training datasets, with 40,000 feature datasets chosen as test datasets. The hidden vector dimension and the learning rate are the two parameters that most influence the machine learning algorithm FM's performance. As a result, four different parameter settings with an average attack rate of 2.2 Mbps were chosen for the experiment. The testing revealed that the approach could successfully detect LDDoS attacks on the SDN data layer, with a detection accuracy of 95.80%. The FM approach produces a stable environment for guarding against LDDoS attacks since it can identify fine-grained LDDoS attacks. With a 97.85% success rate in forwarding regular packets, it uses experimental simulation and analysis to demonstrate the defensive strategy's efficacy. The NSL-KDD, DARPA98, and CAIDA datasets were used to assess performance in a simulated environment. In [76], [PERSON] et al. proposed Q-MIND: a machine-learning-based defense framework in SDN to defeat LDDoS attacks. The authors begin by looking at the adversary model for LDDoS attacks, as well as critical weaknesses in SDNs and characteristics of LDDoS attack. They describe Q-MIND, which includes the optimal strategy of the Q-learning proxy to defend against LDDoS attacks in SDN effectively. Throughout the training phase, the authors require a collection of labeled traffic data that includes both anomalous and benign samples.