# Hybrid Deep Learning Approach for Automatic DoS/DDoS Attacks Detection in Software-Defined Networks
## 4 Observation and Results
### Synthetic Dataset  
In this study, we conducted an extensive evaluation of our proposed model and the GRU method for detecting DDoS attacks in a SDN environment, with a particular focus on low-rate DDoS attacks. In order to collect flow data and simulate various types of DDoS attacks, we used the Ryu controller and the Hping3 tool, respectively.  
After applying our proposed model and the GRU method in this environment, we found that our hybrid algorithm outperformed both methods in all evaluation matrices with the same number of epochs (7). This superior performance can be attributed to the excellent loss rate of 0.004 achieved by our hybrid algorithm, which is a measure of how well the deep learning algorithm fits the dataset. In contrast, the GRU method recorded a loss rate of 0.448, indicating a lower fit to the dataset.  
\begin{table}
\begin{tabular}{c c c c c} \hline  & **Precision** & **Recall** & **F1 Score** & **Support** \\ \hline False & 1.00 & 1.00 & 1.00 & 3090 \\ \hline True & 1.00 & 1.00 & 1.00 & 3129 \\ \hline Accuracy & & & 1.00 & 6219 \\ \hline Macro avg & 1.00 & 1.00 & 1.00 & 6219 \\ \hline Weighted avg & 1.00 & 1.00 & 1.00 & 6219 \\ \hline \end{tabular}
\end{table}
Table 1: Classification report.  
Figure 12: ROC curve related to CICDDoS2019 dataset.  
The loss rate is a crucial metric to consider when evaluating the performance of a deep learning algorithm, especially in the context of detecting low-rate DDoS attacks. This is because low-rate DDoS attacks can be more difficult to detect due to their subtle nature, and a low loss rate indicates a better fit to the dataset, which ultimately translates to better performance in detecting these types of attacks.  
Overall, our results demonstrate the effectiveness of our hybrid algorithm in detecting low-rate DDoS attacks in an SDN environment, and they highlight its potential as a valuable tool in safeguarding against these types of cyber threats. In addition, our findings suggest that our hybrid algorithm may be a promising approach for detecting DDoS attacks in other datasets and environments.  
Examination of Figure 13 reveals that our hybrid algorithm surpasses the performance of alternative methods when evaluated on unseen data, exhibiting excellent performance across multiple metrics. Specifically, the algorithm achieves near-optimal values for several key evaluation measures while also minimizing the associated loss, thereby indicating its effectiveness in addressing the problem at hand.  
Figure 13: The results of our proposed hybrid method with the GRU method regarding the generated dataset.  
To compare the performance of our hybrid approach with the GRU method, we used the receiver operating characteristic (ROC) curve as a measure of effectiveness. The results, shown in Figure 14, indicate that our hybrid algorithm achieved an AUC of 0.9988 while the GRU algorithm had an AUC of 0.7133. This represents a significant advantage for our proposed method, which outperformed the GRU method by more than 40%. Based on the AUC values, it is clear that our approach is superior to the GRU algorithm in terms of accurately distinguishing between normal and attack traffic.