## 3 Methodology
### Algorithms Used for Optimal Controller Placement
The attributes of this dataset are shown in Table 1. Columns 0 to 17 represent independent features, and column 18 is the dependent feature. To the best of our knowledge, this dataset is the first collected in a multi-controller environment and does not require any packet capturing or monitoring overhead, which would add unnecessary strain on the controller. Instead, this dataset relies solely on reading the statistics from flow tables provided by OpenFlow switches. This approach helps reduce congestion in the control plane, unlike those that utilize CIC datasets. ### Dataset Preprocessing

To refine the dataset, several steps were undertaken. First, rows with \(nan,inf,-inf\) values were eliminated. The entire dataset was sorted based on the time attribute for better organization. Feature selection was performed, and irrelevant columns--namely, columns 1, 2, 3, 4, and 5--were dropped, which was guided by correlation analysis to extract meaningful insights. Now, all data were already in numeric format, so no additional numericalization was required. The dataset was then split into training (80%) and testing (20%) sets followed by normalization of the training and test set. Finally, to address binary class imbalance and prevent any over-reliance of labeled data in multi-controller environments, random undersampling was applied. The processed dataset was then used for training ML models and also for testing the performance. The best-performing model was used for the IDS system. ### Machine Learning Algorithms Used for Training Dataset

ML, a subfield of artificial intelligence, focuses on the development and use of statistical algorithms to generalize from data and perform tasks without explicit programming. ML algorithms have been widely applied to various classification and prediction problems. In our study, several classification algorithms were evaluated, namely, Naive Bayes, \begin{table}
\begin{tabular}{|c|c|c|} \hline
**Column Number** & **Feature Name** & **Description** \\ \hline
0 & _time_ & time of arrival at the controller \\
1 & _switch_id_ & datapath ID of switch \\
2 & _ip_src_ & source IP address \\
3 & _src_port_ & TCP or UDP port number \\
4 & _ip_dst_ & destination IP address \\
5 & _dst_port_ & TCP or UDP port number \\
6 & _ip_proto_ & IP protocol \\
7 & _icmp_type_ & type of ICMP packet \\
8 & _flow_duration_sec_ & active time period of flow in sec \\
9 & _flow_duration_nsec_ & active time period of flow in nsec \\
10 & _remaining_idle_time_ & remaining idle time of flow \\
11 & _remaining_time_ & total remaining time of flow \\
12 & _packet_count_ & total packets \\
13 & _byte_count_ & total bytes \\
14 & _packet_count_per_second_ & number of packets in 1 sec \\
15 & _packet_count_per_nsecond_ & number of packets in 1 nsec \\
16 & _byte_count_per_second_ & number of bytes in 1 sec \\
17 & _byte_count_per_nsecond_ & number of bytes in 1 nsec \\
18 & _label_ & benign (0) or attack (1) \\ \hline \end{tabular}
\end{table} 
Table 1: Details of the generated dataset. XGBoost, KNN, random forest, neural networks (NNs), and LSTM. The NN model was implemented with three sequential layers using ReLU and Sigmoid activation functions along with the Adam optimizer. The input layer consisted of 13 neurons to process features from the dataset, while the second layer contained 32 neurons with ReLU activation. The output layer had a single neuron with Sigmoid activation for binary classification. The model was trained using binary cross-entropy as the loss function, running over 100 epochs with a batch size of 10,000. The LSTM model was developed using a sequential architecture. Its first layer included a bidirectional LSTM, which processed input sequences in both forward and backward directions, capturing past and future contexts. This LSTM layer consisted of 64 units, used the hyperbolic tangent (tanh) activation function, and applied L1 regularization. A second, fully connected dense layer with 128 units employed the ReLU activation function and L2 regularization.