# Hybrid Deep Learning Approach for Automatic DoS/DDoS Attacks Detection in Software-Defined Networks
## 3 The Proposed Method
### Tools and Environment  
For this section, we mentioned tools and the environment as the following:  
1--Hypervisor: Our choice fell on VirtualBox to simulate these nodes and create a virtual network close to a real network. 2--UBUNTU Server: Installed a controller and switch on the ubuntu server in virtual machines. 3--Controller: Feature richness, ease of use, and implementation language play a significant role in controller choice. We chose the RYU SDN controller for the following reasons:  
* Compatibility with UNIX systems also supports Python language;
* Simple to install and deploy due to availability in Python environments such as Anaconda, which provides the required dependencies, and ease of installation using \"pip\" as package manager;
* Support all versions of OpenFlow;
* Ability to monitor traffic. 4--Switch: Open vSwitch is well suited to operate as a virtual switch in VM environments and supports several Linux-based virtualization technologies, including VirtualBox. 5--SDN environment: Mininet provides SDN's virtual examination and development environment. It enables SDN development on any laptop or PC. It provides an extensible Python API for creating networks and experimenting. The similarity of the programming language between the Ryu controller and the Mininet environment makes deploying a virtual testbed more flexible. We used the Ryu controller rather than the default Mininet controller and the built-in Open vSwitch switch. All environmental elements above were employed to generate our dataset and check our proposed approach's efficiency. Moreover, after uploading our two datasets on Google Drive, we linked them with Google Colab to check our results and to evaluate our algorithm's performance. 6--Google Colab and Google Drive: To execute our Python code and follow the organized stages of our hybrid approach, from data pre-processing to presenting the results, we used Google Colab. Additionally, we utilized Google Drive to host our datasets and linked them with Google Colab to ensure a consistent environment for comparison with other research. This allowed us to efficiently run our code and easily access and manipulate our datasets throughout the project. 7--CICDDoS2019 dataset: The Canadian Institute for Cybersecurity created a dataset comprising thousands of synthesized DDoS attack scenarios based on actual attacks documented in 2019, with a particular focus on volumetric attacks that aim to overwhelm a network or server with a high volume of traffic, causing denial of service to legitimate users. By using this dataset, we were able to evaluate the performance of our proposed hybrid deep learning approach in detecting volumetric DDoS attacks in software-defined networking (SDN) environments. Figure 1 illustrates the percentage breakdown of traffic types in the dataset. The CICDDoS2019 dataset is a recent addition to the field of cybersecurity, which includes a large-scale, labeled dataset of DDoS attacks on IoT devices. The dataset contains 15 different types of network-based attacks, along with normal traffic, and comprises a total of 2,000,753 samples. The data were collected in a lab environment, emulating a real-world network. The features of the dataset include network flow features, transport layer features, and application layer features, and it has a total of 115 features. One of the unique features of this dataset is its focus on DDoS attacks against IoT devices, which are becoming increasingly common and challenging to detect. The inclusion of various types of attacks and normal traffic provides a comprehensive representation of network traffic, making it suitable for developing and testing intrusion detection systems. Moreover, the large number of samples and variety of attacks in the dataset enables the development of robust and accurate machine learning models for detecting attacks in IoT networks. In summary, the CICDDoS2019 dataset provides a valuable resource for cybersecurity researchers and practitioners to develop and evaluate intrusion detection systems for IoT networks.