## 5 Vulnerabilities of SDN to LDDoS Attacks
### Classification-Based LDDoS Detection
Since data flow management and analysis are already part of the SDN architectural design, this model is unlikely to increase network traffic complexity. The accuracy of the performance evaluation was 93% for the classification of the traffic by the proposed machine learning model. 6.1.1 Implementation and Traffic Analysis of Classification-Based Methods for LDDoS Attack Detection  
This section presents the implementation and deployment of classification-based LDDoS attack detection methods as well as the analysis of traffic and datasets used. Table 3 shows a summary of the simulation environment analysis and traffic/datasets used by existing methods. In [81], the authors carried out the experiment using a Mininet simulator and Ryu controller to set up an SDN network simulation platform. Under the simulation stage, the server targets the data layer with LDDoS attacks. Two actual hosts are utilized in this experiment. One of the hosts is in charge of operating Mininet. The other host is in charge of running the Ryu controller. The OpenFlow protocol, version 1.3, was employed as the southbound interface protocol in the experiment. The topology of the experimental simulation network uses a tree network design with 4 OpenFlow switches and nine hosts. The link bandwidth is set to 10 Mbps for all hosts linked with a delay of 5 ms, link loss is 0, and the maximum queue size is 1000. The experiment employs the D-ITG (distributed Internet traffic generator) to produce traffic in the background using The ITGSend, and ITGRecv commands on each host node to send and accept traffic. The authors used the CAIDA dataset and injected 100 flows into the network topology as a background flow. Among the 100 background flows, TCP streams account for 80%, ICMP 15%, and UDP 5%, with an average background traffic rate of roughly 1.3 Mbps. \begin{table}
\begin{tabular}{l l c c c} \hline \hline
**Reference** & **Experiments** & **Dataset** & **Controller** & **Scale** \\ \hline [PERSON] et al. & Simulation & NSL-KDD, & & & Medium (4 switches, 9 hosts) \\ [81] & using Mininet & DARPA98, CAIDA & & & \\ [PERSON] et al. & Simulation & CAIDA & ONOS & Small (1 switche, 8 hosts) \\ [76] & using MaxiNet & & & & \\ [PERSON] et al. & Simulation & CIC & ONOS & Small (3 switches, 5 hosts) \\ [17] & using Mininet & & & \\ [PERSON] et al. & IoT hybrid Network & Custom & Floodlight & Medium (4 switches, 9 hosts) \\ [78] & & Simulation & & & \\ [PERSON] et al. & Simulation & KDD99 & Ryu & Small (2 switches, 6 hosts, \\ et al. [77] & using Mininet & KDD99 & Ryu & and 1 webserver) \\ [PERSON] et al. & Simulation using & Custom & Ryu & Medium (4 switche, 80 hosts) \\ [79] & & Mininet-WiFi & Custom & Ryu & Small (2 switches, 6 hosts) \\ [PERSON] et al. & Simulation & Custom & Ryu & Small (2 switches, 6 hosts) \\ [83] & using Mininet & & & \\ [PERSON] et al. & Simulation & CIC & POX & Medium (4 switches, 9 hosts) \\ [80] & using Mininet & Custom & ONOS & Small (2 switches, 10 hosts) \\ \hline [PERSON] et al. & Simulation & & & \\ et al. [82] & using Mininet & CIC & Ryu & Medium (6 switches, 21 hosts) \\ \hline [PERSON] et al. & Simulation & & & \\ [84] & using Mininet & CIC & Ryu & Medium (6 switches, 21 hosts) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Implementation and traffic analysis of existing methods. In [76], the experiment uses MaxiNet [109] as a simulation platform and ONOS as the SDN controller. The authors established a simple SDN-based network with a web server and eight hosts. There are four malicious hosts and four benign hosts. All hosts and the webserver run in Linux containers connected by an OpenFlow switch. The authors consider three machine learning-based classifiers (SVM, RF-, and SOM). The feature used is created from 10 convenient features. These features are extracted from a traffic dataset containing 4000 normal traffic samples and 4000 attack samples for each source IP address. The dataset was generated from the conducting simulation experiment for stealthy DoS attacks and the CAIDA dataset.