# Comparison of ML/DL Approaches for Detecting DDoS Attacks in SDN  
[PERSON]  
1 National Advanced IPv6 Centre, Universit Sains Malaysia, Gelugor 11800, Malaysia 1  
[PERSON]  
1 National Advanced IPv6 Centre, Universit Sains Malaysia, Gelugor 11800, Malaysia 1  
[PERSON]  
1 National Advanced IPv6 Centre, Universit Sains Malaysia, Gelugor 11800, Malaysia 1  
Footnote 1: email: {[PERSON]  
In line with traditional networks, DDoS attacks have the potential to impact a switch's processing power or the connections between switches in the SDN data layer. This article focuses on volumetric DDoS attacks, which are the most common and long-term threat due to the rapid growth of network devices connected to the internet. To achieve early detection, ML/DL is employed to analyze the behavior, which is a new research area in the SDN, as machine response is faster than human response. Using ML/DL techniques, computers can learn from experience, analyze data attributes, or utilize trial-and-error procedures to make judgments. They serve as a supplementary method to assist network operators in understanding the situation. While a single threshold may theoretically identify flooding DDoS attacks, it may be difficult to differentiate normal burst traffic from attack traffic. One way to increase accuracy is to establish a DDoS attack definition after the threshold has been reached several times in a row. This approach allows for burst traffic while also delaying detection. Prior to defining a flooding DDoS attack, it may be possible to observe or analyze network traffic behavior to improve accuracy and hasten detection [6]. DoS/DDoS attacks pose a serious threat to SDNs, as they can cause congestion in the control plane, data plane, or control plane bandwidth, and may even bring down the entire network by targeting the network's brain--the controller. DoS/DDoS attacks on the SDN data plane can exhaust the OpenFlow switch's flow table RAM, resulting in discarded packets, and create new flows that do not match the switch's flow table entries, leading to a buffer overflow. These issues can cause delays and increase the amount of communication bandwidth required. To address these challenges, it is crucial to develop a solution that can protect against DoS/DDoS attacks while still enabling the forwarding of legitimate traffic, ensuring the proper handling of packet-in messages, and securing the communication channel between the OpenFlow switches and the SDN controller. This article contributes to the field of intrusion detection by estimating and investigating the projected model using ICIDS2017 and CICDDoS2019 datasets. By training and testing the model with various types of datasets and comparing the results with past research, the impact of these data on the model detection behavior can be understood, and the kinds of features that would improve model performance can be identified. As a result of these analyses, it will be possible to create unique features and feed the model for training. Additionally, this article provides a summary of the output, analyzing and comparing each ML/DL approach's accuracy performance in detail. The deployment of the ML/DL overhead is also illustrated by examining the ML/DL classifier's time process for both learning and prediction. This compiled summary enables the proposal of an adaptive mechanism composed of a combination of ML/DL algorithms to enhance the model detection process with high performance, low-time detection, and low complexity. The results of the tests indicate that (i) the data-preprocessing (DP) and ML/DL system can be applied in a single SDN-CO for estimating DDoS attacks, (ii) an ML/DL system is capable of detecting DDoS attacks with a selected input, (iii) the presence of odd instances in the learning set has little effect on the estimate's accuracy for regular valid data, and (iv) incorporating more information and characteristics in the learning process can improve results, but overfitting may occur.