# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 5 Available Benchmarked DDoS Datasets and Classes of Attacks in Datasets
\begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Ref.** & **Year** & **Approach** & **Dataset** & **Classes-of-Attacks** \\ \hline [PERSON] et al. [43] & 2018 & BAT, Ensembl & KC, NK, NY & DoS, Probe, R2L, U2R \\ [PERSON] et al. [44] & 2018 & RF, DAE & KC, NK & DoS, Probe, R2L, U2R \\ [PERSON] et al. [45] & 2018 & FLN & KC & DoS, Probe, R2L, U2R \\ [PERSON] et al. [46] & 2018 & SVM, SAE & NK & DoS, Probe, R2L, U2R \\ [PERSON] et al. [47] & 2018 & GPU & NK & DoS, Probe, R2L, U2R \\ [PERSON] et al. [48] & 2018 & SAE, SVM & NK & DoS, Probe, R2L, U2R \\ [PERSON] et al. [49] & 2018 & SVM, DBN & NK, UN, C7 & DoS, Probe, R2L, DDoS, Web \\ [PERSON] et al. [50] & 2018 & KMC, RF & KC & DoS, Probe, R2L, U2R \\ [PERSON] et al. [51] & 2019 & ensemble & NK & DoS, Probe, R2L, U2R \\ [PERSON] et al. [52] & 2020 & KNN, RF, DT & CS & HeartBelled, DoS, Botnet, DDoS \\ [PERSON] et al. [53] & 2019 & DNN, LSTM & C7, A9 & Benign, DoS, Goldberg, DoS, DDoS, [PERSON] et al. [54] & 2020 & DT, KNN, NB, DNN & KC & DoS, Probe, R2L, U2R \\ [PERSON] et al. [55] & 2020 & DNN & C7 & Botnet, DoS, DDoS, Web \\ [PERSON] et al. [56] & 2020 & DNN & C7 & Botnet, DoS, DDoS, Web \\ [PERSON] et al. [57] & 2020 & DNN & C9 & Data flooding of UDP flooding attack \\ [PERSON] et al. [58] & 2021 & DNN & C9 & UDP, SYN, DNS, Benign \\ [PERSON] et al. [59] & 2021 & DNN & C9 & DDoS attacks \\ [PERSON] et al. [60] & 2018 & CNN & OBS & DDoS \\ [PERSON] et al. [61] & 2019 & CNN & NK & DoS \\ [PERSON] et al. [62] & 2019 & CNN & C7,K9 & DoS, Probe, R2L, U2R, DDoS \\ [PERSON] et al. [63] & 2019 & CNN & NK & DoS, Probe, R2L, U2R \\ [PERSON] et al. [64] & 2020 & RNN, LSTM & C7 & Botnet, DoS, DDoS, Web \\ [PERSON] et al. [65] & 2020 & Entropy, CNN & C7 & Botnet, DoS, DDoS, Web \\ [PERSON] et al. [66] & 2020 & CNN & KC, C8 & Botnet, DoS, DDoS, Web \\ [PERSON] et al. [67] & 2020 & CNN & I2, C7, C8 & Botnet, DoS, DDoS, Web \\ [PERSON] et al. [68] & 2020 & CNN & C9 & DDoS attacks \\ [PERSON] et al. [69] & 2020 & CNN & C9 & Syn, TETP, DNS, LDAP, UDP \\ [PERSON]. [70] & 2018 & LSTM, CNN, GRU & I2 & DDoS attack \\ [PERSON] et al. [71] & 2019 & LSTM & I2 & DDoS attack \\ [PERSON] et al. [72] & 2019 & LSTM & C7 & Botnet, DoS, DDoS \\ [PERSON] et al. [73] & 2020 & LSTM & C9 & MSSQL, SSDP, CharGen, LDAP, NTP \\ [PERSON] et al. [37] & 2021 & GRU & CS, C9 & DDoS attacks \\ [PERSON] et al. [7] & 2019 & AE, ANN & U5, KC & DoS, Probe, R2L, U2R \\ [PERSON] et al. [74] & 2019 & AE, MKL & I2, US & Fuzzers, Backdoors, Analysis, DoS \\ [PERSON] et al. [75] & 2020 & AE & U7 & (HTTP, Hulk and Slowloris) attack \\ [PERSON] et al. [76] & 2020 & AE, SVM & C7, NSL, KDD & (HTTP, Hulk and Slowloris) attack \\ [PERSON] et al. [77] & 2020 & AE, DNN & C7, NSL, KDD & (HTTP, Hulk and Slowloris) attack \\ [PERSON] et al. [81] & 2020 & RBF & Generated dataset & DDoS \\ [PERSON] et al. [38] & 2019 & MLP, CNN, LSTM & C7 & DoS, Probe, R2L, U2R \\ [PERSON] et al. [41] & 2019 & LST, BN & I2 & DDoS \\ [PERSON] et al. [39] & 2020 & CNN, LSTM & C7 & DDoS \\ [PERSON] et al. [42] & 2020 & RNN, AE & C9 & DDoS \\ [PERSON] et al. [40] & 2020 & CNN, LSTM & generated & DDoS \\ [PERSON] et al. [78] & 2020 & LANN & generated & DDoS \\ [PERSON] et al. [79] & 2022 & reinforcement & generated & DDoS \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The most current research on ML/DL for DDoS attack detection, showing techniques, datasets, and types of attacks. **CIC-IDS2017:** the Canadian Institute of Cyber-Security (CIC) produced this dataset in 2017. New actual assaults and typical flows are both included. CICFlowMeter uses data from records, source and destination IP addresses, protocols, and assaults to assess the network traffic. CICIDS2017 includes typical attack cases such as Brute Force Attacks, HeartBleed Attacks, Botnets, Distributed DoS (DDoS), Denial of Service (DoS), Web Attacks, and Infiltration Attacks [83].