## 5 Vulnerabilities of SDN to LDDoS Attacks
### Classification-Based LDDoS Detection
The typical quantitative ratio for test datasets and the training dataset is 20% for the test and 80% for the training. The procedure employs binary classification methods such as SVM, NB, and RF. The experimental results showed that the model accuracy of detecting LDDoS attacks is 97% from the controller view of the network traffic. In [77], [PERSON] et al. proposed a framework to identify and defend against LDDoS attacks based on machine learning for the campus network. The framework consists of two phases: the network traffic acquisition module and the LDDoS attack identification module. The traffic acquisition module extracts network traffic features to prepare traffic identification for SDN network. They used the SVM algorithm and traffic features obtained from statistical flow table data to identify the attack traffic, demonstrating how LDDoS attacks may deplete controller sources and providing a way out to detect attacks with the changing of the target IP address. Traffic data were obtained from entries in the traffic flow tables. The traffic dataset includes traffic that denotes a TCP connection with eight features. These features are divided into two categories: Host-based and Time-based network traffic. The SVM model is built using LKF (Linear Kernel Function) and a decision function is obtained in order to determine how the packets should be sent. It is an LDDoS attack packet if the output of the function is \(-1\); otherwise, it is a normal packet. The experiment yielded an accuracy of 0.998, indicating the effectiveness of the model. The model has a high detection rate for recognizing LDDoS attacks and is implemented as an LDDoS detection module in a simulated SDN context of a campus network. The controller drops packets that match the configured rule when an attack flow is selected. In [79], [PERSON] et al. proposed DIAMOND as a structured coevolution method to optimize features for LDDoS attack detection in SDN-enabled IoT networks. The method aims to find the optimal features to improve the detection performance of LDDoS attack detection methods. DIAMOND consists of a clustering algorithm to sort the achievable number, a commutation strategy, a group structuring method, and a co-crossover strategy. By analyzing the information about SDN-enabled IoT network features in the solution space, the relationship between various SDN-enabled IoT network features and the optimal solution is investigated in DIAMOND. Then, the individuals with the related SDN-IoT network features are divided into different subpopulations, resulting in a structure tree. Moreover, multiple structure trees evolve in coordination with each other. The evaluation results show that DIAMOND can effectively select optimal low-dimensional feature sets and improve the performance of the LDDoS detection method in terms of detection accuracy and response time. DIAMOND is implemented on the SDN controller and collects network traffic by sending aggregated traffic instructions to the OpenFlow switches. It works as follows: Once the SDN controller receives the instructions, it sends OFPT_STAT_REQUEST messages to the switches to obtain flow entry statistics. The switches respond to the SDN controller with OFPT_STAT_ REPLY messages. These messages contain stream data in the flow entries for the switches. After the controller receives OFPT_STATS_ REPLY messages, it deletes them and sends the collected statistical data to DIAMOND. The statistical data of the stream entries collected from the switches are used to calculate the initial SDN-enabled IoT network features. Then, these features are encoded using the binary coding method to generate the initial community, which consists of some individuals. The population is divided into several subpopulations by BONNET. The structuring factor is calculated based on the fitness and membership factors, which assemble the individuals in the subpopulation into a skeleton tree. Multiple skeletal trees evolve cooperatively with each other through mutation.