# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 3 Most Up-to-Date ML/DL Techniques for Detecting DDoS Attacks
The most popular models of this kind include:
* **Recurrent Neural Networks (RNN):** RNNs were developed to improve upon the capabilities of traditional feed-forward neural networks and model sequence data. Input, hidden, and output units make up an RNN, with the hidden units acting as the memory elements. In order reach a decision, each RNN unit considers both the current input and the results of prior inputs. RNNs are commonly used in a wide range of fields, such as semantic comprehension, handwriting prediction, voice processing, and human activity identification [33]. RNNs can be used for feature extraction and supervised categorization in DDoS detection. However, RNNs can only manage sequences up to a certain length before running into short-term memory problems [34]. * **Long Short-Term Memory (LSTM):** LSTM is a DL structure that has successfully addressed the challenges of RNNs. An LSTM network is composed of different memory cells or blocks. The following cell receives both the hidden state and the cell state through three mechanisms known as gates, specifically, forget, input, and output gates [35]. The memory blocks may choose which data to recall or ignore. A forget gate eliminates information from the current input that the LSTM no longer requires [36]. The output gate is responsible for extracting pertinent data from the current input and processing it as an output. Finally, the input gate is responsible for adding inputs to the cell state [37]. **Semi-supervised learning:** semi-supervised learning involves using unlabeled data in the pre-training stage of the algorithm. This approach trains a model using both labeled and unlabeled data. In this case, the features are extracted using an autoencoder and classification is performed using various deep or shallow machine learning models. AutoEncoding (AE) is a common deep-learning method that belongs to the unsupervised neural network family. By learning the best features, AE aims to match the output to the input as closely as possible. Although the dimensions of the hidden layers are often smaller than those of the input layer, an autoencoder has input and output layers of the same dimension. Symmetric encoder-decoder operation is a key aspect of AE. Stacked AE, Sparse AE, and Variational AE are three different versions of AE [13]. **Hybrid learning:** a comdination of any two other methods, such as shallow machine learning, supervised deep learning, or unsupervised deep learning, is known as a hybrid learning method. Researchers have commonly employed CNN-LSTM [38; 39; 40]), LSTM-Bayes [41], RNN-AE [42], and other hybrid models. **Other learning methods:** this group includes transfer learning, in which a pre-trained model from a repository is used in a transfer learning technique [13]. In these cases, researchers use deep learning techniques train models on one attack domain before applying them to another. This section has provided a thorough summary of the most popular ML and DL algorithms for DDoS detection systems. Figure 4 illustrates the taxonomy of current ML/DL-based DDoS detection approaches.