# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 5 Available Benchmarked DDoS Datasets and Classes of Attacks in Datasets
Hyperparameters are crucial because they directly affect how ML training algorithms behave. Prior to training the model, certain hyperparameter values must be chosen, which calls for specialized expertise and experience. There are two approaches for hyperparameter tuning, namely, manual search and automated search techniques. In a manual search, values for the hyperparameters are chosen manually. The automated search technique is similar to grid search, however, the grid search approach is more expensive. Another approach, known as a random search, has been introduced to address the grid search issue. Examples of hyperparameters include the number of epochs, batch size, learning rate, training algorithm, amount of layers, amount of neurons in each layer, etc. An experimental setup includes information about the program, dataset, physical hardware, and other aspects of the experimentation process. As the training and testing \begin{table}
\begin{tabular}{p{56.9 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & **Preprocessing Strategies** & **Hyperparameter Values** & **Experimental Setups** & **Performance Metrics** \\ \hline [PERSON] et al. [38] & & A 1D CNN layer with ReLu function, LSTM layer with Adam optimizer, dropout layer with a rate of 0.5, FC layer, and dense layer with sigmoid function make up the CNN–LSTM model & Intel Core-17 with Keras, TensorFlow, and MATLAB & Precision = 97.41\%, Recall = 99.1\%, Accuracy = 97.36\% \\ \hline [PERSON]. et al. [41] & Feature hashing and BOW & Two hidden FC layers of 256 neurons each with ReLU activation function and one neuron with sigmoid activation function make up the LSTM module. & GPU NVIDIA GTX 1050 & Recall = 97.6\%, Accuracy = 98.15\%, Precision = 98.42\%, TNR = 98.4\%, FPR = 1.6\%, F1-Score = 98.05\% \\ \hline [PERSON] et al. [39] & Min-max & Maxpooling, LSTM, and dropout layers with ReLu activation function after a 1D CNN; learning rate = 0.001, batch size = 256, epochs = 100, and dropout rate = 0.2\%. & NVIDIA Tesla VIO GPUs with TensorFlow and Keras software & Accuracy = 99.03\%, Recall = 99.26\%, F1-Score = 99.36\%, Training Time = 15,313.10 s \\ \hline [PERSON] et al. [42] & Min-max & Four RNN hidden layers in the RNN-AE; the channel counts for the encoder phase are 64, 32, 16, and 8, with two softmax functions & Accuracy for identification of attacks was 0.99\%, whereas for benign cases it was 1.00. On the F1 scale, attack cases scored 0.99\%, AUC = 98.8 \\ \hline [PERSON] et al. [81] & & Constant Bit Rate (CBR) application, 200 nodes, 500 s of simulation duration, and 5\% to 20\% of the regular nodes as attacking nodes. & Attack rate between 5\% and 15\%, detection rate between 86\% and 99\%, and false alarm rate of 15\% \\ \hline [PERSON] et al. [40] & Min-Max & Flatten, maxpool, and dropout layers. Following the LSTM layer, there is an FC dense layer with a ReLu function, a dropout layer, and the last dense layer with a sigmoid function. Epochs = 50, training = 0.0005, dropout rate = 0.3, kernel size = 5, and the CNN filter is set to 64 \\ \hline [PERSON] et al. [78] & & Eight FC layers in 8 LANN. Pooling layers and the ReLu function are applied after each layer, with the eighth layer being the exception, 500 batches, a cross-entropy loss function, an SGD optimizer, and a training rate of 0.001 were utilized in this experiment. & Ubuntu 16.04 with NVIDIA RTX 2080 Ti & Accuracy = 87.8\% and Transferability = 19.65. \\ \hline [PERSON] et al. [79] & Game with Post-Decision (GPDS) & Post-Tel(R) technique & Addresses the MDP optimization problem by offering a unique policy-based multi-user reinforcement learning game technique & Tensorflow and Intel(R) & According to the experimental findings, the suggested GPDS outperforms SOTA algorithms in terms of anti-jamming performance. \\ \hline \hline \end{tabular}
\end{table} 
Table 5: \(Cont.\)timeframes rely on the hardware setup, it is particularly crucial. Due to the complexity of ML/DL algorithms, suitable hardware configurations are needed.