# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 5 Available Benchmarked DDoS Datasets and Classes of Attacks in Datasets
\begin{tabular}{c} **Performance Metrics** \\ \end{tabular}  \\ \hline [PERSON] et al. [66] & & 117 features and pictures, with 13 and 9 pixels and the kernel size set to 2 and 3, respectively & Python and TensorFlow & KC accuracy = 99\%, CSE8 = 91.5\% \\ \hline [PERSON] et al. [67] & Min-max & n = 100, t = 100, k = 64, h = 3, m = 98, batch size = 2048, LR = 0.01, Adam optimizer, and sigmoid & Two 16-core Intel Xeon Silver 4110 CPUs with TensorFlow and Python & Accuracy = 0.9888, FPR = 0.0179, Precision = 0.9827, Recall = 0.9952, F1-score = 0.9889 \\ \hline [PERSON] et al. [68] & Shannon Entropy & CNN model consisting of three layers: a Flatten layer, a 0.5 Dropout layer, and an FC layer with ten neurons, two Conv1D layers, and MaxPooling1D layers with sigmoid and 1000 epochs & Intel Core i7 & SDN data on average Accuracy, Precision, recall, and F-measure (95.4\%, 93.3\%, 2.4\%, 92.8\%) for CIDDoS 2019. \\ \hline [PERSON] et al. [69] & Min-max & Ten CLs and eight PLs in a ResNet18 model, learning rate = 0.0001, momentum = 0.9, epochs = 10 and 50 with SGD optimizer & F1-measure = 86, Precision = 87\%, Recall = 86\%, Accuracy = 87.06\% for multiclass and 99.99\% for binary \\ \hline [PERSON] et al. [70] & BOW and a 3D matrix used to convert a 2D feature matrix & Input, forward recursive, reverse recursive, FC hidden, and output layers making up a DL model. & 128 GB of RAM and two NVIDIA K80 GPUs with Keras and Ubuntu & Accuracy = 98\% \\ \hline [PERSON] et al. [72] & \begin{tabular}{c} Examined a sub-sequence of n-packet flows \\ \end{tabular}  & Two LSTM layers, with a series of ten packets extracted from each flow & F1-score = 0.9991, Precision = 0.9995, Recall = 0.9997 \\ \hline [PERSON] et al. [73] & RF & Three LSTM layers with 128 neurons each and sigmoid function, three dropout layers, and a dense layer with tanh function & Accuracy = 99.19\% \\ \hline [PERSON] et al. [37] & MD5 & A dropout layer with a dropout rate of 0.5 and an FC layer with ten neurons and sigmoid function & Intel Core i7, Keras and Sklearn soft-ware & Average metrics for accuracy, precision, recall, and F-measure values on the C8 dataset: 97.1\%, 99.4\%, 94.7\%, and 97\%, respectively. Valid flow classification rate: 99.7\%. \\ \hline [PERSON] et al. [7] & Normalization & Three hidden layers, an output layer with 28, 19, 9, 19, and 28 units, and activation function. The input layer has five hidden layers with 28, 500, 800, 1000, 800, and 500 units & NVIDIA Quadro, Python, Keras, TensorFlow, and SciKit-learn libraries & F1-score, Accuracy, Precision, and Recall values: 0.8985, 0.9744, 0.8924, and 0.9053, respectively. \\ \hline [PERSON] et al. [74] & Discretized features are those that are not numerical & Nine MSDAs with different number of layers L = (1, 3, 5, 7, 9, 11) with MATLAB & Average accuracy on Datasets D1 through D16, = 93\%; Accuracy on Dataset D2 = 97\%. \\ \hline [PERSON] et al. [75] & Flow split into several sub-flows based on a threshold value of 10 milliseconds & One input layer, three hidden layers, and one output layer, with 27, 24, 16, 24, and 27 neurons in each layer, respectively & Exp1: DR = 98.32\%, FPR = 0.38\%; U7: DR = 94.10\%, FPR = 1.88\%; SYNT: DR = 100\%; FPR = 100\%; Exp2: DR = 94.14\%, FPR = 1.91\%. \\ \hline [PERSON] et al. [76] & Min-max & 25 hidden neurons, 82 hidden input neurons and 82 hidden output neurons, 0.3 learning rate, 0.2 momenta, with 25 input nodes and two output nodes in the SVM. Learning rate = 0.01 and iterations = 1000. & Intel Core (TM) & Training Time = 2.03 s, Testing Time = 21 milliseconds, C7 Accuracy = 99.90\%. For the created DDoS assaults, Accuracy = 99.1\% and AUC = 0.9988. For the NSL-KDD test, Accuracy = 96.36\% \\ \hline [PERSON] et al. [77] & Min-max & Two encoding layers with 70 and 50 neurons each, a coding layer with 25 neurons two decoding levels with 25 neurons each, and ReLu activation in each layer. Utilized the Adadelta optimizer and sigmoid activation in the output layer & Intel(R) Core-i7 & NSL-KDD. Accuracy = 98.43\%, Precision = 99.22\%, Recall = 99.12\%, Recall = 99.