## 3 Methodology
### Algorithms Used for Optimal Controller Placement
Consequently, XGBoost achieves a higher F1-score, reflecting a better balance between precision and recall. \begin{table}
\begin{tabular}{|c|c|c|c|c|} \hline
**Model** & **Train Time** & **Test Time** & **Train Acc.** & **Test Acc.** \\ \hline Random Forest & 946 ms & 106 ms & 98.65 & 97.00 \\ \hline XGBoost & 728 ms & 70 ms & 97.3 & 98.5 \\ \hline Naive Bayes & 54 ms & 42 ms & 67.7 & 91.53 \\ \hline KNN (n = 3) & 198 ms & 126 ms & 94.51 & 93.32 \\ \hline NN & 11.6 s (50 epochs) & 4s & 91.62 & 93.6 \\ \hline LSTM & 15 m (15 epochs) & 16s & 99.9 & 99.9 \\ \hline \end{tabular}
\end{table} 
Table 2: Performance in terms of train–test time and train–test accuracy in terms of percentage. Therefore, as XGBoost offered both an optimum balance of test accuracy (98.5%) and test time (70 ms) for our detection mitigation system, based on these results, we implemented XGBoost in our IDS to maximize the system performance. Figure 12: Performance of different models: train and test accuracy. Figure 13: Performance of different models: train and test time. The receiver operating characteristic (ROC) curve depicted in Figure 16 reveals findings that support Table 2. Better classifying algorithms have a strong inclination toward the top left corner. Complex deep learning models such as LSTM outperformed other models. But despite the best performance, for our case, it took a significantly high prediction time of 16 seconds to classify the same data in comparison to XGBoost, which took 70 ms. The high testing time is proportional to the decision time of the IDS. If LSTM had been implemented, it would have resulted in a higher response time due to the time-series nature and sliding window methodology, which adds additional computational overhead. Therefore, it is not suitable for near real-time detection and mitigation. Consequently, LSTM was not implemented in our model. Figure 14: Performance graph of ML models: metrics for label 0. Figure 15: Performance graph of ML models: metrics for label 1. From Table 3, the data presented demonstrate that our work point to a significant improvement in multi-controller DDoS detection. While several studies, such as [PERSON] et al. [39] and [PERSON] et al. [40], achieved strong results with respect to accuracy, precision, and recall in single-controller setups, our LSTM model with 99.9% test accuracy has achieved what we believe to be state-of-the-art performance, particularly in the more complex multi-controller context. Specifically, we mentioned only the InSDN dataset from the work by [PERSON] et al. [39], as it best represents the SDN environment, although other datasets were also considered in their paper. Compared to a single-controller setup, a multi-controller SDN setup is more complex. In the case of a single controller scenario, for an attack mitigation action, both the source and victim are present inside the domain of the same controller. This setup of a simple detection and mitigation algorithm can be executed on the single controller (simple algorithm in the sense that with a lesser number of controllers involved, there will be fewer things to take care of and the use cases are also relatively narrow for practical cases). However, when either an attacker or a victim lies in a separate domain, single controller algorithms cannot be employed because a coordinating mechanism is required between controllers. To address this problem, we need a more advanced mechanism where attacks from different controller domains can also be handled. For this, we implemented Algorithms 2 and 3 in a multi-controller environment. This setup naturally forms a complex network with the necessity of a more advanced algorithm, since data from domains of multiple controllers should be looked at while making decision and multi-controllers should also be in correlation (via IDS) such that mitigation is performed by precisely locating the attacker. Furthermore, controller placement considerations [28] are also important while dealing with multi-controller environments, adding extra complexity.