# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
###### Abstract  
The recent advancements in security approaches have significantly increased the ability to identify and mitigate any type of threat or attack in any network infrastructure, such as a software-defined network (SDN), and protect the internet security architecture against a variety of threats or attacks. Machine learning (ML) and deep learning (DL) are among the most popular techniques for preventing distributed denial-of-service (DDoS) attacks on any kind of network. The objective of this systematic review is to identify, evaluate, and discuss new efforts on ML/DL-based DDoS attack detection strategies in SDN networks. To reach our objective, we conducted a systematic review in which we looked for publications that used ML/DL approaches to identify DDoS attacks in SDN networks between 2018 and the beginning of November 2022. To search the contemporary literature, we have extensively utilized a number of digital libraries (including IEEE, ACM, Springer, and other digital libraries) and one academic search engine (Google Scholar). We have analyzed the relevant studies and categorized the results of the SLR into five areas: (i) The different types of DDoS attack detection in ML/DL approaches; (ii) the methodologies, strengths, and weaknesses of existing ML/DL approaches for DDoS attacks detection; (iii) benchmarked datasets and classes of attacks in datasets used in the existing literature; (iv) the preprocessing strategies, hyperparameter values, experimental setups, and performance metrics used in the existing literature; and (v) current research gaps and promising future directions. machine learning; deep learning; distributed denial-of-service; datasets +
Footnote †: journal: Medical Informatics
Defending against DoS and DDoS attacks is more challenging in SDN than in traditional networks. These types of attacks have become significant threats to computer networks, causing a decline in network performance by consuming available resources and disabling services. An effective DoS/DDoS attack intentionally depletes resources and prevents hosts from accessing the targeted service. In SDNs, a DoS/DDoS attack can overwhelm the control plane, data plane, or control plane bandwidth, potentially bringing down the entire network. An attack on the data plane may consume all of the OpenFlow switch's limited flow table RAM, resulting in the discarding of packets and the inability to install newly received flow rules. DoS/DDoS attacks on the data plane may also involve the generation of a large number of new flows that do not correspond to flow table entries. These packets are buffered by the switch, and if the buffer fills up, the entire packet is sent to the controller rather than just the headers through packet-in messages. This can cause delays in installing new flow rules and higher communication bandwidth use [5]. The primary distinction between DoS and DDoS assaults is that DoS utilizes many internet connections to take the victim's computer network offline, whereas DDoS assaults use a network of devices controlled by the attacker. DDoS assaults are more challenging to detect and trace because they are launched from various locations, and the attack volume used is enormous. DDoS assaults are carried out differently from DoS attacks, which are often carried out via a script or a DoS tool like Low-Orbit Ion Cannon. Types of DDS attacks include buffer overflows, ICMP floods, teardrop attacks, and flooding assaults, whereas types of DDOS attacks include volumetric attacks, fragmentation attacks, application layer attacks, and protocol attacks. DDoS assaults are more destructive than DoS attacks because they involve several systems, making it more challenging for security teams and products to pinpoint the source of the attack [6]. The aforementioned examples highlight the requirement for a reliable approach to identifying DDoS assaults. DDoS assaults may be detected using a variety of approaches, including statistical analysis, ML/DL, etc.