## 3 Methodology
### Algorithms Used for Optimal Controller Placement
Furthermore, our optimal XGBoost model achieved an accuracy that is only 1.49% lower than the best models. This shows that despite focusing on both detection and mitigation while considering both accuracy and latency, our approach delivers competitive performance compared to models that prioritize accuracy alone. Additionally, our dataset differs from those of the mentioned models, as it is the first dataset collected in a multi-controller environment and contains different feature sets, marking a considerable contribution to the field of SDN DDoS security. Figure 16: ROC curve of different models. While the comparison metrics (accuracy, precision, and recall) of the mentioned works in the Table 3 are very similar, the major contrasting factor of our work is the setup of the SDN environment. Our setup of multi-controllers and a primary dataset, differing from other research, for the ML model provides a more closer resemblance to real-world scenarios. Despite the complicated setup of a multi-controller environment with a central IDS trained using a primary dataset obtained from SDN itself, our performance metrics manages to stand on par with the recent works on SDN DDoS security. The notable thing in our work is we have indeed made use of simpler attacks (ICMP, TCP SYN, UDP flood attacks), which could have been easily resolved by simpler non-ML algorithms like entropy methods, bandwidth probes, hybrid statistical methods, etc. We went with an ML-based approach to exploit its learning capabilities. Traditional algorithms that are mostly threshold-based seem to need manual tuning to adapt to different rates of attacks. Hence, to eliminate the necessity of any manual tuning, we utilized the ML approach, which was also able to detect attacks efficiently. Additionally, we aim to establish a base framework of ML on this flow table-based dataset in a multi-controller environment. The detection of advanced attacks like LDDoS, ping of death, and application layer DDoS are kept as future works on this new framework. ### Attack Detection and Mitigation

After XGBoost was deployed in both Savvis and Aarnet networks, our mitigation and detection algorithm were verified by two separate cases, namely, with and without the mitigation module. In the presence of a DDoS attack, it is expected for the victim to have a high number of incoming packets. Without the mitigation module in action, a high number of packets from the DDoS attack are being sent to the victim, as evident in Figures 17 and 18. \begin{table}
\begin{tabular}{|c|c|c|c|c|c|} \hline
**Author** & **Domain** & **Dataset** & **Accuracy** & **Precision** & **Recall** \\ \hline \multirow{3}{*}{[PERSON] et al. [25]} & Logically Single & \multirow{3}{*}{CICDDoS Dataset} & \multirow{3}{*}{99.42} & \multirow{3}{*}{99.40} & \multirow{3}{*}{99.46} \\  & Distributed Controllers & & & & \\ \hline [PERSON] et al. [39] & Single & InSDN & \multirow{3}{*}{99.74} & \multirow{3}{*}{99.74} & \multirow{3}{*}{99.74} \\  & Controller & & & & \\ \hline [PERSON] et al. [40] & Single & Custom & \multirow{3}{*}{99.99} & \multirow{3}{*}{99.99} & \multirow{3}{*}{99.99} \\  & Controller & Dataset & & & \\ \hline [PERSON] et al. [41] & Single & Novel & \multirow{3}{*}{98.97} & \multirow{3}{*}{98.33} & \multirow{3}{*}{96.37} \\  & Controller & Dataset & & & \\ \hline [PERSON] et al. [42] & No SDN & DDoS SDN & \multirow{3}{*}{99.50} & \multirow{3}{*}{99.40} & \multirow{3}{*}{99.50} \\  & Setup & Dataset & & & \\ \hline \multirow{3}{*}{Our model} & Optimally & Flow & \multirow{3}{*}{98.50} & \multirow{3}{*}{97.00} & \multirow{3}{*}{97.00} \\  & Placed Multi- & Table-Based & \multirow{3}{*}{(Optimal)} & \multirow{3}{*}{(Optimal)} & \multirow{3}{*}{(Optimal)} \\  & Controller & Custom & \multirow{3}{*}{99.99 (Best)} & \multirow{3}{*}{99.99 (Best)} & \multirow{3}{*}{99.99 (Best)} \\ \end{tabular}
\end{table} 
Table 3: Comparison with recent works on DDoS detection. With the mitigation module in action, there is a significant reduction in the number of packets, as shown in Figures 19 and 20.