# Comparative Study of AI-Enabled DDoS Detection Technologies in SDN
## 2 Research Background and Motivations
### Related Works and Research Motivations  
We discuss some machine learning and deep learning-based solutions. The authors of [15] used different machine learning algorithms for the detection of DDoS attacks in an SDN environment and compared the results. Ref. [16] provided a survey of current research related to the security of the SDN paradigm. In [17], the authors proposed a lightweight DDoS attack detection mechanism. In [18], an energy-based model was proposed, with recurrent, conventional and fully connected components, and the reported F-measure was 73.9% and 73.2%. In [19], a deep neural network was used for anomaly detection, with a 75% F-measure. In [20], three hidden layers and one output layer were used. Two hidden layers trained the model using Autoencoder, and classification took place in the last layer using SoftMax. They reported a 97% F-measure. In [21], the authors designed FCN, VAE and LSTM-Seq2 Seq structures for anomaly detection in a network and stated that the LSTM-Seq2 Seq structure yielded 99% classification accuracy. In [22], a study was conducted to detect DDoS in a cloud environment by applying multiple regression analysis \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Method** & **Advantages** & **Issues** \\ \hline \multirow{4}{*}{Time-Based DDoS Detection} & Contains a mitigation process by creating time patterns to prevent future attacks. Reduces controller processing rate because the flow collector handles this task. & Causes time delay because the processor adds more processing for non-valid packets. Requires additional implementation. \\ \cline{2-3}  & & Lightweight method. Detects DDoS attack at early stages. Flexible; can modify any parameter. & Additional overhead from window size. Unable to detect DDoS attacks on multiple hosts. No prevention technique. \\ \cline{2-3}  & & Introduces a high overhead reduction compared to other techniques. & This technique is not implemented with normal switches. It requires additional implementation. \\ \cline{2-3}  & & - & Ability to monitor multiple points instead of one. \\ \hline \multirow{4}{*}{
\begin{tabular}{} \end{tabular} } & Introduces a high overhead reduction compared to other techniques. & Can be implemented on network system. Requires additional functionalities. \\ \cline{2-3}  & - & Less CPU load. & Can be implemented on network system. Requires additional functionalities. \\ \cline{2-3}  & - & Fast detection time. & Can be implemented on network system. Requires additional functionalities. \\ \cline{2-3}  & - & & Requires additional functionalities. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of different methods used for DDoS attacks in SDN. to the CICIDS 2017 benchmark dataset. In order to detect DDoS attacks in real time, big data access methods have been studied [23], and research to detect Botnet attacks has also progressed [24; 25; 26]. Recently, research aimed at detecting and mitigating DDoS attacks based on machine learning [27; 28; 29; 30] and deep learning [31; 32] has been conducted. The motivation of our study is to devise an excellent DDoS detection performance model by comparing existing machine learning and deep learning models in an SDN environment. The fundamental intention of our study is to reduce the developer's initial burden by presenting a comparison of the detection performance of the existing models when developing a new AI-enabled DDoS detection model. Initially, we apply 84 DDoS candidates' data in the original Kaggle dataset, and the features affecting detection are reduced to 64 and 20. After analyzing the DDoS dataset collected from the first Kaggle dataset, 84 candidates' data are manually selected. In the next step, a meaningful dataset for DDoS attacks is determined step by step using the permutation importance algorithm. In this process, it is confirmed that even if various types of DDoS attacks occur, the top 20 attacks that affect the performance of SDN are affected.