# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 3 Most Up-to-Date ML/DL Techniques for Detecting DDoS Attacks  
The field of ML is a subfield of artificial intelligence (AI) that encompasses all techniques and algorithms that allow computers to automatically learn from big datasets by applying mathematical models. Decision Tree (DT), K-Nearest Neighbor (KNN), Artificial Neural Network (ANN), Support Vector Machine (SVM), K-Means Clustering, Fast Learning Networks, Ensemble Methods, and others are the most popular ML methods used for DDoS detection in SDN (sometimes called Shallow Learning). The brief explanations of each category are as follows:  
* **Decision Tree (DT):** a fundamental supervised ML method that leverages a set of rules to classify and predict data using regression. The model is structured as a tree with nodes, branches, and leaves, where each node represents a feature or characteristic. Each leaf on the branch denotes a possible outcome or a class label, and the branch itself signifies a decision or a rule. The DT algorithm automatically selects the optimal attributes for tree construction and performs pruning to eliminate unnecessary branches and prevent overfitting [22]. * **K-Nearest Neighbor (KNN):** the K-Nearest Neighbor (KNN) algorithm is a simple supervised ML method that uses the concept of \"feature similarity\" to classify a given data sample. By determining a sample's identity based on its neighbors and how far away it is from them, KNN can effectively determine the class of a data sample. The value of the KNN algorithm's \(k\) parameter can have an impact on its performance, and selecting a \(k\) value that is too small or too large can lead to overfitting or incorrect categorization of the sample case. To improve the detection rate of attacks in the minority class, researchers using the most recent benchmark dataset, CSE-CIC-IDS2018, have applied the Synthetic Minority Oversampling Technique (SMOTE) to overcome the dataset imbalance issue when evaluating the performance of various ML algorithms, including KNN [23]. * **Support Vector Machine (SVM):** Support Vector Machine (SVM) is a supervised ML method that uses the max-margin separation hyperplane in n-dimensional feature space as its foundation. It can be used to solve both linear and nonlinear issues, employing kernel functions to address the latter. The goal of SVM is to first translate a low-dimensional input vector into a high-dimensional feature space using the kernel function, then to use the support vectors create an optimal maximum marginal hyperplane that serves as a decision boundary. By correctly identifying the benign and harmful classes, the SVM method can be used to identify DDoS attacks with greater efficiency and accuracy [24]. * **K-Mean Clustering:** the goal behind clustering is to group together sets of data that are very similar in order to divide the data into meaningful clusters or groups. One popular iterative ML technique that learns without supervision is K-Mean clustering. Here, \(K\) denotes a dataset's total number of centroids (cluster centers). Distance is typically measured when allocating specific data points to a cluster. The main goal is to decrease the total distance between each data point and its associated centroid within a cluster [25]. * **Artificial Neural Network (ANN):** the functioning of the human nervous system serves as the inspiration for the supervised ML algorithm known as ANN. It consists of neurons (nodes), which are processing units, and the connections that link them together. The organization of these nodes includes an input layer, several hidden levels, and an output layer. A backpropagation algorithm is employed by ANN as a learning method. The capacity of the ANN approach to perform nonlinear modeling by learning from larger datasets is its key benefit. However, the fundamental difficulty with training ANN models is the lengthy procedure required, as its complexity can hinder learning and result in less than ideal results [26].