# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 8 Conclusions and Future Directions  
It may be quite difficult to distinguish between DDoS assaults with various rates and patterns and normal traffic. Over the years, many effective ML/DL methods for DDoS attack detection have been suggested by different researchers. Sadly, however, the applicability of these techniques is severely constrained due to attackers constantly changing their attack tactics. Findings involving the SLR protocol are evaluated and drawn from in this review in order to assess the state-of-the-art DDoS assault detection systems based on ML/DL approaches. The literature has been summarized in Section 4 in accordance with the suggested taxonomy for DDoS attack detection using ML/DL techniques, with each study's respective advantages and disadvantages listed. The accuracy rate reported in much of the literature is over 99%. Because the majority of these studies assessed their models using offline data analysis for evaluation and comparison, certain metrics for performance may vary in a real-world or production settings. In particularly, we note that existing papers have generally not employed the same DS or assessment techniques, making comparisons between their results difficult. With respect to the datasets most often used in the literature, 29% of studies utilized the current well-known research dataset CICIDS2017, 23% used the CICDDoS2019 dataset, 18% used the ISCX2012 dataset, 10% used the NSL-KDD dataset, 10% used the KDDCUP99 dataset, 5% used the UNSW-NB15 dataset, 3% used the CSE-CIC-IDS2018 dataset, and 2% used the Kyoto 2006 dataset. Figure 5a displays the efficacy of the investigated ML/DL-based DDoS attack detection techniques on the CICIDS2017 dataset. It can be seen that methods relying on CNN [64,67], DNN [56], AE-SVM [76], and CNN-LSTM [39] have all been able to achieve accuracy better than 99%. Figure 5b shows how well the investigated ML/DL-based DDoS attack detection methods performed on the CICDoS2019 dataset. Techniques relying on CNN-based ResNet [69], LSTM [73], DNN [57, 58, 59], and GRU [37] all demonstrated accuracy over than 99%. On the ISCX2012 dataset, the LSTM, CNN, and LSTM-Bayes techniques all showed accuracy lower than 98.8% [70,71]. On the NSL-KDD dataset, only the CNN technique in [63] demonstrated accuracy above 99%, and it required complex calculations to achieve this. We can conclude from this study that the most commonly used preprocessing techniques are BOW, Z-score normalization, one-hot encoding, and min-max normalization. Another conclusion of our review relates to performance metrics. Of the reviewed studies, 29 employed accuracy measurements for evaluating their techniques, compared to 22 studies each using the precision, recall, and F1-score metrics and six studies each using the FPR and AUC metrics. These findings are shown in Figure 6; it can be seen that the majority of papers did not report the testing/training time for their methodologies, despite the fact that these measurements are crucial for system implementation in real-world or production settings. With respect to future research directions, our discoveries on ML/DL techniques for DDoS attack detection point towards the following paths for further study:  
* **Lack of actual implementation of ML/DL systems:** most research focusing on analysis of these models has neglected the crucial need to evaluate the performance of these models in the real-time situations where DDoS attacks actually occur. There remains a pressing need for ML/DL models that have been verified using real-world scenarios. Figure 5: Accuracy of the studied ML/DL approaches on (**a**) the CICIDS2017 dataset [38, 49, 53, 55, 56, 57, 62, 63, 65, 67, 72] and (**b**) the CICDDoS2019 dataset [37, 42, 53, 58, 59, 68, 69, 73]. Figure 6: The proportion of ML/DL methods that utilized different performance indicators.