## 5 Vulnerabilities of SDN to LDDoS Attacks
### Classification-Based LDDoS Detection
The authors use the Markov Decision Process (MDP) approach [107] to realize the optimal combination of a given feature set and performance for AI/machine learning algorithm detection. The MDP architecture allows AOS (Application Operator and Scheduler) to choose the best action (a mixture of features and AI/ML algorithm) based on its inputs to extend its immediate incentive in each loop. They have implemented ten features, including average packet size per stream, stream change percentage, port extension, etc. These characteristics are calculated for each source IP address using a traffic dataset with 8000 samples divided 50% for regular traffic and 50% for attack traffic. As a result, the Q-learning agent must train the detection mechanism and conduct validation tests. They design an optimization problem to find the best policies in scenarios where the immediate reward increases in each loop, using Q-learning to solve it. This method allows AOS to make the best choice without knowing a collection of features or the associated AI/ML technique beforehand. The Q-MIND framework provides results close to those obtained during the cross-validation phase with the optimal policy (close to 98%). To assess attack mitigation performance, the authors look at a fraction of malicious stream rules rejected in the switch and the web server's request-response time when the network is under attack. Q-MIND achieves a high proportion of correctly downed attack streams because it enforces rules when it recognizes a source IP address emanating from an attacker. In [17], [PERSON] et al. proposed a modular architecture for detecting and mitigating LDDoS attack in SDN environments. They used six machine learning models (SVM, J48, Random Tree, REP Tree, MLP, and RF) to train their design and used the CIC (Canadian Institute of Cybersecurity) DDoS dataset with implementing ONOS controller running on the Mininet simulator [108]. Despite the challenges of detecting LDDoS attacks, the evaluation findings reveal that the approach has a 95% detection rate. The interface-based classification technique provides a classify object that defines a stream property with a classifier. The identification API offers a way for trained robots to interact with process flows. The classifier is a collection of learned machine learning models available in IDS. A sophisticated stream object gathers stream information from OpenFlow switches to determine if the traffic is an attack or a normal one. This flow complicated object's properties are based on the flow table. IDS obtains a collection of stream parameters from the input request with traffic flow parameters and the output response with flow classification and then creates the model provided in the request. If the stream is considered to be anomalous,it uses the specified form to classify the input parameters before determining the type of attack. Finally, it generates an attack-type 1 data response or an attack-type 0 response, which it transmits to the IPS. In [78], [PERSON] et al. proposed a learning-based technique for detecting LDDoS attacks on SDN control and OpenFlow switches in an IoT network context. The suggested approach is based on two characteristics derived from the OpenFlow package (stateless and stateless features). Learning techniques are used in the detection system to construct classifiers that distinguish between normal and attack flows. The approach trial's evaluation architecture includes an LDDoS attack module, data flow collection, and feature extraction model. They put several learning algorithms to the test and distributed each feature in the raw data based on the platform. Two sets of stateless vectors and stateless features are created. A training set and test set are created from the produced feature vector dataset. The learning and detection phases of classification-based learning are then separated. Part of the dataset created in the preceding phase is used in each of these work steps. There is no intersection between the two datasets.