# Optimized MLP-CNN Model to Enhance Detecting DDoS Attacks in SDN Environment
## 4 Proposed Model
### OptMLP-CNN Detector
This highlights the model's ability to detect the most genuine DDoS attacks while keeping false negatives minimal. The F1-score, a harmonious metric considering precision and recall, ranges from 99.37% [9] to 99.94% [13] in the benchmark models. In the case of the OptMLP-CNN model, the F1-score attains 99.94% when employed with the CICDDoS-2019 dataset and achieves an even higher F1-score of 99.98% when operating within the InSDN dataset. It is important to note that the AUC, representing the classifier's discriminatory ability, was reported for all models except model [9]. The AUC values for the OptMLP-CNN model are notable, reaching 99.79% with the CICDDoS-2019 dataset and an impressive 99.96% within the InSDN dataset. The presented results indicate that the proposed OptMLP-CNN model consistently exhibits a remarkable performance across diverse datasets, often outperforming or at least matching the capabilities of other established techniques. These findings attest to the model's robustness and potential to bolster network security against the evolving landscape of DDoS threats, with its most exceptional performance observed in the InSDN dataset. The proposed model leverages a combined MLP-CNN architecture, amalgamating the strengths of both models. This fusion enables the model to capture intricate patterns in structured and spatial data, significantly enhancing its adaptability and accuracy across \begin{table}
\begin{tabular}{l l c c c c c} \hline \hline
**Ref** & **Used Dataset** & **Accuracy** & **Precision** & **Recall** & **F1-Score** & **AUC** & **Approach** \\ \hline [PERSON] and & NSL-KDD & 99.84\% & 99.94\% & 98.81\% & 99.37\% & NS & Deep neural network with fusion of \\ [PERSON] [9] & UNSW_NB-15 & 89.03\% & 95.00\% & 98.95\% & 96.93\% & NS & statistical importance by using standard \\  & CIC-IDS-2017 & 99.80\% & 99.85\% & 99.94\% & 99.89\% & NS & deviation \\ \hline Batchu, R. K. and & CICDDoS-2019 & 99.94\% & 99.88\% & 99.99\% & 99.94\% & 99.94\% & Extreme ML with hybrid feature selection \\  & H. [24] & & & & & & \\ \hline Proposed & CICDDoS-2019 & 99.97\% & 98.90\% & 99.99\% & 99.44\% & 99.97\% & Gradient boosting with hybrid feature selection \\  & He. [24] & & & & & based on [PERSON]’s correlation and RF \\ \hline Proposed & CICDDoS-2019 & 99.95\% & 99.90\% & 99.98\% & 99.94\% & 99.97\% & Optimized MLP-CNN with SHAP-feature \\ Model & InSDN & 99.98\% & 99.99\% & 99.97\% & 99.98\% & 99.96\% & selection \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Comparison with previous studies. diverse datasets. Additionally, our approach incorporates SHAP-feature selection, enabling the identification of critical features pivotal for accurate classification, particularly in DDoS-attack detection. Furthermore, the model integrates Bayesian optimization techniques, refining hyperparameters to improve efficiency and precision. This iterative optimization process enhances the model performance and contributes to its adaptability to varying data distributions, ensuring robustness across evolving threat landscapes. Moreover, the continuous monitoring and update mechanisms embedded within our method facilitate real-time adaptation to emerging threats, offering a proactive defense against DDoS attacks. The system's agility in detecting and responding to new attack patterns is a preventive measure, contributing to a more-resilient network infrastructure. By underscoring these advantages, our manuscript now prominently emphasizes our proposed method's unique strengths and benefits, showcasing its potential to significantly improve DDoS-attack-detection strategies. ## 6 Conclusions and Future Work

In conclusion, this study introduced and evaluated the OptMLP-CNN model for detecting DDoS attacks in SDN environments. The model combines the innovative SHAP-feature-selection method to identify the most crucial features and a hybrid DL technique based on MLP and CNN architectures. This combination allows the model to efficiently process and analyze network traffic data, effectively identifying anomalies and DDoS attacks.