# Hybrid Deep Learning Approach for Automatic DoS/DDoS Attacks Detection in Software-Defined Networks
## 4 Observation and Results
### CICDDoS019 Dataset  
Our proposed hybrid algorithm was compared with the GRU algorithm using the evaluation metrics shown in Figure 8. The results indicate that the hybrid algorithm outperforms the GRU algorithm in all metrics, with a particularly significant difference in loss. The accuracy of the hybrid algorithm was 99.81%, while the GRU algorithm achieved an accuracy of 98.86%. These results demonstrate the superiority of the hybrid algorithm in detecting DDoS attacks within SDN environments, with a notable improvement in performance compared to the GRU algorithm. As depicted in Figure 9, our proposed hybrid approach demonstrates superior performance on unseen data, also known as the test data, compared to the GRU method. This suggests that our hybrid approach is more effective at generalizing new data and may be a better choice for real-world applications. Figure 8: The results of our proposed hybrid method with the GRU method regarding the CICD-DoS2019 dataset. The standard procedure for running this algorithm involves training for a set number of epochs, which in this case was 100 epochs as stated in the reference paper. To ensure an optimal training process, we implemented the Early Stopping technique, which monitors the performance of the algorithm on the validation set and stops training if there are no improvements in the data. However, our algorithm achieved the best result at an early stage, as shown in Figure 10, requiring only 10 epochs to reach its maximum performance. This exceptional efficiency is not uncommon in machine learning and deep learning algorithms, as we have observed in previous studies. Figure 10 illustrates the effectiveness of our algorithm in accomplishing the task with minimal computational resources, as evidenced by the red arrow which indicates the number of epochs employed in the experiment. Figure 9: The result or hybrid method with the GRU method regarding the CICDDoS2019 dataset. Figure 11 illustrates the number of epochs required for the GRU method to reach its maximum performance, which was found to be 17 epochs. The red arrow in the figure denotes the number of epochs employed in the experiment, serving as a visual cue for this key parameter. The number of epochs can significantly impact the performance of an algorithm, as it determines the amount of training that the model undergoes. In this case, the GRU method required a relatively high number of epochs to reach its optimal performance, as shown in Figure 11.  
Figure 12 presents the receiver operating characteristic (ROC) curve for the CICD-DoS2019 dataset, comparing the performance of our proposed method with the GRU method. Both approaches achieved good results, with our proposed method slightly outperforming the GRU method. Specifically, the area under the curve (AUC) for our proposed method was 0.9999, which is extremely close to the ideal value of 1, while the GRU method achieved an AUC of 0.9973. These results suggest that both methods are effective at distinguishing between normal and attack traffic, with our proposed method exhibiting a slight edge in terms of overall performance. Figure 11: The number of epochs of the GRU method. Figure 10: The epochs number of our proposed method. The values, as shown in Table 1, of this confusion matrix represent the performance of a classification model. It consists of two classes, false and true, and the model's predictions were compared against the true labels. The matrix shows that there were a total of 6219 instances, out of which 3090 were correctly classified as false and 3129 were correctly classified as true. This gives an overall accuracy of 1.00 or 100%. The macro average and weighted average for precision, recall, and F1 score is also 1.00, indicating that the model performed equally well for both classes. The high accuracy and precision values suggest that the model is performing very well, and there are no false positives or false negatives.