# Real-Time Detection of DDoS Attacks Based on Random Forest in SDN
## 3 Materials and Methods
### DDoS Attack Detection
#### 3.2.3 Random Forest Optimization  
After various machine learning comparisons, we have selected RF as the algorithm for DDoS attack detection. RF, as an integrated learning algorithm, is generated by combining multiple decision tree models. In RF, each decision tree is generated independently and its generation process is based on different random samples and subsets of features. The basic principle of RF is to reduce the risk of overfitting a single decision tree by constructing multiple decision trees, thus improving the generalization ability of the model. Each decision tree in RF is trained on a randomly sampled subset of the original data. RF performs classification or regression by voting or averaging the output of each decision tree [31]. The RF has several important parameters. The most important of these parameters is the sampling rate, the number of decision trees, and the number of features in each decision tree. By tuning these parameters, the accuracy and computational efficiency of RF \begin{table}
\begin{tabular}{c c c} \hline \hline
**Classification** & **Algorithm** & **Definition** \\ \hline Filter & Variance & Remove features that show the same value for most of them. \\  & Mutual Information & Reciprocal information measures how much information the presence/absence of a feature has to make a correct prediction for Y. \\ Wrapper & Backward Elimination & A base model is used to perform multiple rounds of training, sequentially removing non-conforming ones until a certain criterion is met. \\ Embedded & Lasso(L1) & Lasso regression restricts the model coefficients by adding L1 regularization. \\  & Random Forest & The generalization of the model is improved by constructing multiple decision trees to reduce the risk of overfitting a single decision tree. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Feature selection classification. can be controlled. RF has a wide range of applications in many fields, including finance, healthcare, natural language processing, computer vision, etc. Its advantages include high accuracy, the ability to handle a large number of features and samples, the ability to identify important features, the ability to handle missing data, etc. As shown in Figure 6. The basic process of the RF algorithm is as follows. 1. Random sampling: many samples are taken from the original training set using the Bootstrap sampling method (with put-back sampling) as a new training set. 2. Random feature selection: a portion of the original feature set is randomly selected as the new feature set, and only this portion of the features is considered when building the decision tree. Figure 6: Random forest algorithm flow chart. 3. Construction of the decision tree: the decision tree is built based on the new training set and feature set, with each node division being based on a random subset of the feature set. 4. Integration of RF: multiple decision trees are generated and eventually each sample is classified or regressed by voting or taking the average. The RF algorithm has the following advantages. 1. RF algorithms are more capable of handling high-dimensional data and large-scale datasets. 2. The RF algorithm can effectively avoid the problem of overfitting. 3. The RF algorithm can handle both discrete and continuous data. 4. The RF algorithm can give the importance ranking of variables, which is a convenient for feature selection. To further improve the performance of the RF model, we used the DDoS2019 dataset to optimize the main parameters of RF sample, depth, and estimator. The optimization Algorithm 3 is as follows. First, we initialized the RF by setting sample = 0.9, depth = 20, and estimator = 100. First, we set the sampling rate of the RF from 0.1 to 0.9 (step = 0.1) by controlling the variables depth = 20 and estimator = 100 to find the optimal sample in the generated evaluation metrics.