# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 4 Methodologies, Strengths, and Weaknesses
\begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline
**Reference** & **Methodology** & **Strengths** & **Weaknesses** \\ \hline [PERSON] et al. [49] & Used SVM and Deep Belief Network & DBN was utilized to extract features, which were then passed on to an ensemble SVM before being predicted through a voting method & Model complexity and training require a longer time with more deep layers. \\ \hline [PERSON] et al. [50] & K-Means Clustering and Random Forest-based multilevel model & The clustering idea was applied in combination with RF to offer a multilayer intrusion detection model; the model performed better than average in identifying assaults & Used the outdated KDDCup99 dataset to test the model. \\ \hline [PERSON] et al. [51] & Employed a voting system and ensemble ML techniques and DNN, and used an adaptive voting mechanism to select the best classifier & An earlier dataset called NSL-KDD was used to test the model; the results on weaker attack classes were insufficient. \\ [PERSON] et al. [52] & Comparison of the performance of several ML algorithms by first lowering the dataset imbalance ratio using SMOTE & SMOTE & Longer execution times \\ \hline [PERSON] et al. [53] & Two ML models (DNN and LSTM) were proposed for the detection of DDoS assaults & The performance of these models significantly improved, with DNN and LSTM accuracy levels of 98.72\% and 96.15\%, respectively. AUC values for the DNN and LSTM were 0.987 and 0.989, respectively & The authors did not use real-time detection, and only binary class classification was carried out. \\ \hline [PERSON]. et al. [54] & Identifying DDoS assaults in the cloud utilizing DT, KNN, NB, and DNN algorithms & The DNN classifier outperformed DT, KNN, and NB in terms of accuracy and precision, achieving 96\% on the cloud dataset & Employed an outdated dataset; there was no information provided regarding the LAN or the cloud dataset. \\ \hline [PERSON] et al. [55] & Developed a DNN architecture & The proposed DeepDetect model outscored other strategies and produced an F1-score of 0.99. Additionally, the AUC value was very near to 1, demonstrating great accuracy & This strategy was only tested against DDoS assaults at the application layer. \\ \hline [PERSON]. et al. [56] & Identified sluggish DoS assaults on HTTP and suggested a data flow-based DNN algorithm & The model could categorize assaults with a 99.61\% overall accuracy & Only slow HTTP DoS attacks were assessed using this method; the CICIDS2017 dataset was used. \\ \hline [PERSON] et al. [57] & Identified DF or UDPFL attacks in MANETs using the CIDDoS2019 dataset and suggested a DL model DNN using two hidden layers and six epochs & Recall = 1, Precision = 0.99, F1-score = 0.99, and Accuracy = 0.99 & This study focused solely on DF or DPFL attacks, and used the CICDDoS2019 dataset. \\ \hline [PERSON] et al. [58] & Combined two DNN models except a CNN ensemble were outperformed by the suggested framework & Because of its complicated structure, the suggested model’s performance in a real-time environments may suffer as a result of longer detection times. \\ \hline [PERSON] et al. [61] & Combined FCNN with Vector VCNN & Nearly 100\% accuracy for DatasetA. Additionally, when using DatasetB the model correctly categorized DDoS assaults with a 95\% accuracy rate & For multiclass classification, the suggested model performed less accurately. \\ \hline [PERSON] et al. [62] & Suggested a Multi-channel CNN architecture for DDoS assaults & The proposed technique performed better than three other ML methods & The dataset utilized included a limited number of cases and excluded several forms of traffic. \\ \hline \end{tabular}
\end{table} 
Table 3: Cont.