# Comparison of ML/DL Approaches for Detecting DDoS Attacks in SDN
## 2 Related Work
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Ref.** & **ML/DL** & **Exper.** & **Dataset** & **Features** & **Remarks** \\ \hline
[7] & NB,SVM,NN & Mininet & Real-time & Host connections per second & In the SDN, SVM may be used as an IDS. \\ \hline
[8] & DT & VM & Self-generated & flag, TTL, and src/dst IP & A detection time of 0.6 s and accuracy of 98\% for DDoS attacks. \\ \hline
[9] & KNN,DT, NN & A real testbed & CAIDA 2007 & Ports and ICMP packets per IP & A minimally intrusive defense with a flexible monitor window period. The precision may exceed 98\%. \\ \hline
[10] & SVM,KNN, RF & Mininet & NSL-KDD & Unmentioned specifics & SVM model improvement. Nearly 99\% of the time, it is accurate. \\ \hline
[11] & DA,SVM, KNN,NB,DT & VM & ISCX data & Number of bytes and packets, flowduration (FD), NumberOfBytes over & Although ML/DL may be used in the SDN as a classifier, choosing the right characteristics for improved detection can be challenging. \\ \hline
[12] & SVM, KNN, NN, NB & VM & Self-generated & 12 features & The detection accuracy can be increased by filtering important features via feature selection prior to training. \\ \hline
[13] & SKNN, NB, SVM & Mininet & Self-generated & Length, duration, size, and speed of the flow rate & The basic KNN model may be enhanced by adding a weight value to the neighbors. From simulation, the efficiency is astounding. \\ \hline
[14] & NB & Real testbed & NSL-KDD & 25 features selected & The proposed strategy for DDoS mitigation has yielded promising results among ISPs. \\ \hline
[15] & Soft-max, NN, Autoencoder & Real testbed & Self-generated & 34 features selected & Individual DDoS attack detection accuracy can exceed 95\%, and attack categorization accuracy can exceed 99\%. \\ \hline
[16] & SVM & Real testbed & KDD 1999, KDD-CUP 1999 & 30 features selected & The amount of characteristics used to categorize traffic affects accuracy. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Existing ML/DL methods to defend SDN from DDoS assaults. This model regularly obtained flow information from switches using the SDN controller and extracted key features using kernel analysis. The SVM parameters were then modified using genetic algorithms to make the best possible predictions. The accuracy of the proposed model was evaluated using simulations and public datasets, and it achieved close to 99% accuracy. [PERSON] et al. [11] compared seven classifiers in terms of initialization times and accuracy and found that SVM had the highest accuracy (93%) with the lowest detection time. [PERSON] et al. [12] focused on feature selection techniques and compared four ML algorithms. They found that KNN, a wrapper-based algorithm, performed the best with 98.3% accuracy when using six essential factors for selection. Both studies provide useful insights into the effectiveness of different ML/DL methods for DDoS attack recognition. In a network system, it is possible to locate the ML/DL component on a remote network instead of an application over the controller [13]. [PERSON] et al. [14] connected four ISPs in a setup scenario and considered the use of an ML server that employs NB classification outside the network. Upon receiving a fresh incoming packet, the controller extracts the features, and then the ML server examines it. If the CO receives an anomalous estimate outcome from the ML model, it will notify the CO to deny these packets to prevent network attacks. The ML server selects 25 traffic characteristics to learn from, but this is decreased to 18 due to poor real traffic processing. However, the accuracy in the normal condition is less than 70%, and 92% in the aberrant condition, which is not very encouraging. To analyze network traffic, [PERSON] et al. [15] proposed running three modules, namely TCFI, FE, and TC, over the controller. TCFI stores packet headers for FE in addition to replies to fresh flow requests.