## 3 Proposed Approach
### Proposed Methodologies
#### 3.2.3 Fc2 Gen
## 4 Performance Evaluation

Here, we provide the reader with the necessary information regarding the undertaken tests using a number of different methods as well as some results showing the efficiency of our approaches. ### Simulation Setup and Metrics

The utilized dataset, referenced in [34], is purposefully curated for Software-Defined Networking (SDN) applications and is generated using the Mininet emulator. Its main objective is to facilitate the classification of network traffic through machine learning and deep learning algorithms. The project initiates by configuring ten distinct network topologies within the Mininet environment, connecting switches with a single Ryu controller. The network simulation includes benign TCP, UDP, and ICMP traffic, alongside various types of malicious traffic, such as TCP Syn attacks, UDP Flood attacks, and ICMP attacks. Characterized by 23 features, the dataset includes extracted attributes from switches (e.g., switch-id, packet_count, byte_count, duration_sec, and duration_nsec) and calculated parameters. The extracted information comprises the source IP, destination IP, port numbers, tx_bytes, rx_bytes, and the dt field indicating the date and time. The calculated features encompass the packet per flow, byte per flow, packet rate, packet_ins messages, total flow entries, tx_kbps, rx_kbps, and port bandwidth. The dataset's final column acts as the class label, distinguishing between benign (labeled as 0) and malicious (labeled as 1) network traffic. The network simulation spans 250 min, resulting in a dataset comprising 104,345 rows of data. The metric that was used in this work is the average class error, which essentially shows the percentage of a classification error using a number of algorithms. In this way, we can be certain regarding the performance efficiency of the simple grammatical evolution algorithms as opposed to other simple algorithms. ### Experimental Results

Here, we use the aforementioned dataset in order to show the efficiency of our approach. We performed experiments, initially, using three methods, namely the Bayes, K-Nearest Neighbors (KNNs) [35; 36; 37], and Random Forest [38; 39; 40] methods, as opposed to GenClass. These algorithms are common in classification and they have been chosen to show the efficiency of the GenClass algorithm. Our results show that GenClass is superior to the other methods since it exhibits 6.58% error as opposed to the Bayes method error of 32.59%, KNN method error of 18.45%, and the Random Forest error of 30.70%. The results can be seen in Figure 2.

Thereafter, we performed experiments using two other methods with grammatical evolution, namely the Neural Network Constructor (NNC) [32] and FC2 GEN [33]. The results can be seen in Figure 3. As we can see, the GenClass method is better, exhibiting less class error comparing to the two competitors. In particular, GenClass exhibits 6.58% error, while NNC and FC2 GEN exhibit average class error values of 12.51% and 15.86%, respectively. However, the results that the NNC and FC2 GEN exhibited are satisfactory in terms of performance. In summary, we see that grammatical evolution provides good results. Figure 2: Error of methods in %. ## 5 Conclusions

This paper delves into Software-Defined Networking (SDN) research, exploring a dataset encompassing a spectrum of network traffic patterns, inclusive of both benign and malicious data. This dataset encompasses 23 unique features tailored for classification purposes. The study employed grammatical evolution as its classification methodology, utilizing evolutionary algorithms to decipher intricate data patterns. This research concluded by presenting findings that assess the efficacy of the grammatical evolution-based classification approach. These results yielded valuable insights into the method's performance, contributing significantly to comprehending SDN security and the evolving landscape of network traffic classification within this dynamic field.