# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 4 Methodologies, Strengths, and Weaknesses
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Reference** & **Methodologies** & **Strengths** & **Weaknesses** \\ \hline [PERSON] et al. [63] & Used two datasets to test the suggested model against classification algorithms including DT, SVM, KNN, and NN & Suggested model scored well and provided 99\% accuracy on both datasets & In this method, the data were transformed into a matrix by extending one column. As a result, this may influence how the model learns. \\ \hline [PERSON] et al. [64] & Suggested a deep CNN framework for the detection of DDo6 assaults in SDN & Ensemble CNN technique performed better than the currently used rival approaches, attaining a collective 99.45\% accuracy rate & This strategy requires longer training and testing periods. As a result, the mitigating mechanism may be impacted, meaning that assaults can cause more damage. \\ \hline [PERSON] et al. [65] & Suggested an information entropy and DL technique to identify DDo5 assaults in an SDN context & The CNN outperformed alternatives in terms of precision, accuracy, F1-score, and recall, with an accuracy rate of 98.98\% & The model Required a longer to perform time detection \\ \hline [PERSON] et al. [66] & Created a CNN-based model to identify Do5 attacks & The CNN model is better able to recognize unique Do5 assaults with similar features. Additionally, CNN kernel size had no discernible effect on either binary or multiclass categorization & Longer time detection \\ \hline [PERSON] et al. [67] & DDo5 assaults were detected using the LUCID approach & LUCID’s performance was better in terms of accuracy & The padding might interfere with CNN’s ability to learn patterns. Additionally, there were compromises between accuracy and the amount of memory required. The preprocessing time was not been computed for real-time situations \\ \hline [PERSON] et al. [68] & Suggested an SDN defense mechanism & Overall findings demonstrated effectiveness of the CNN in identifying DDo5 assaults for each of the test cases & When using the CICDDo6 2019 dataset, the model exhibited worse accuracy. \\ \hline [PERSON] et al. [69] & Suggested a technique for converting three-channel picture formats from non-image network data & The suggested strategy obtained 99.92\% accuracy in binary-class classification & The preparation time for transforming non-images to images was not calculated. Additionally, the processing used to convert the original 60 \(\times\) 60 \(\times\) 3 dimensions into the 224 \(\times\) 224 \(\times\) 3 dimensions used as the input for the ResNet model was been specified \\ \hline [PERSON] et al. [70] & Suggested a deep learning approach & DDo6 assault detection was 98\% accurate & Long time required for detection \\ \hline [PERSON]. et al. [71] & A DL-based approach was developed & For all the test cases, it was noted that the LSTM model displayed 98.88\% accuracy. The module was able to prevent an attacked packet from reaching the cloud server via the SDN OF switch & Only DDo5 assaults at the network or transfer-level were examined; real-time feasibility analyses of the proposed model were not conducted. \\ \hline [PERSON] et al. [72] & A four-layered architectural model with two LSTM layers was suggested & Experimental findings demonstrated that the LSTM-based technique performed better than other approaches & When the flow consisted of short packets, N was padded with fictitious packets. These padding settings have the potential to degrade performance, and have an impact on how the suggested model learns. \\ \hline [PERSON]. et al. [73] & Two methods, a hybrid-based IDS and a DL model based on LSTM, were proposed for Do5/DDo6 assaults detection & The LSTM-based model reached an accuracy of 99.19\% & A long time was required for detection \\ \hline [PERSON] et al. [37] & Proposed a defense mechanism against DDo6 and intrusion assaults in an SDN environment & The average results for the accuracy, recall, precision, and f1-score were 99.94\% and 97.09\%, respectively & The model used a complex framework \\ \hline [PERSON] et al. [7] & Cpmbo a deep ANN and AE model & The best F1 values with the ReLu activation function were obtained (0.8985). For the activation functions of softplus, softsign, relu, and tanh, the overall accuracy, and precision are close to 99\% & The activation functions are the sole thing this article focuses on \\ \hline [PERSON] et al. [74] & Proposed a deep AE for feature learning and the MKL framework for detection model learning and classification & The proposed approach was found to be more accurate than alternative approaches & Used an outdated dataset \\ \hline \hline \end{tabular}
\end{table}