# Comparison of ML/DL Approaches for Detecting DDoS Attacks in SDN
## 5 Discussion and Result
Additionally, only [10] discovered it with 1562.75 s of training time, but in our simulated test, it took 316.36 s.  
According to a survey of the literature, the greatest KNN accuracy and training time are 89.21% and 0.848 s, respectively, in [9], while the F1-score has 0.848 in [12]. The statistics for training accuracy (91.23%), prediction accuracy (90.61%), F1-score (0.88), and training time (0.033 s) are higher in our test. The greatest F1-score and accuracy for DT were (94.8%) and (0.9051) concurrently in [8], and training time (0.505 s) in [9]. The numbers for training \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Algorithm** & **Train Accuracy \%** & **Prediction Accuracy \%** & **F1-Score** & **MCC** & **Training Time (s)** & **Predict Time (s)** & **Tuning Parameter** \\ \hline SVM & 94.86 & 94.01 & 0.97 & 0.94 & 316.36 & 54.83 & \begin{tabular}{c} kernel = ‘liner’, C = 1, gamma = 1, random\_state = 0 \\ \end{tabular} \\ \hline KNN & 90.14 & 89.16 & 0.88 & 0.802 & 0.033 & 9.46 & \begin{tabular}{c} n\_neighbors = 161, p = 2, \\ metric = ‘euclidean’ \\ \end{tabular} \\ \hline DT & 95.33 & 93.14 & 0.96 & 0.93 & 0.45 & 0.006 & \begin{tabular}{c} max\_depth = 5, random\_state = 0 \\ \end{tabular} \\ \hline MLP & 91.21 & 91.11 & 0.89 & 0.81 & 59.26 & 0.026 & \
\begin{tabular}{c} random\_state = 0, max\_iter = 200, \\ alpha = 1 \\ \end{tabular} \\ \hline CNN & 95.18 & 89.61 & 0.84 & 0.96 & 1800.59 & 157.22 &
\begin{tabular}{c} Conv2D(64,(3,3), strides = (2,2), \\ padding = ‘same’, \\ input\_shape(2,3,3), \\ activation = ‘relu’ \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Findings from the five classification algorithms applied to the CICIDS2017 dataset. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Algorithm** & **Train Accuracy \%** & **Prediction Accuracy \%** & **F1-Score** & **MCC** & **Training Time (s)** & **Predict Time (s)** & **Tuning Parameter** \\ \hline SVM & 95.08 & 95.57 & 0.97 & 0.94 & 316.36 & 54.83 & \begin{tabular}{c} kernel = ‘liner’, C = 1, gamma = 1, random\_state = 0 \\ \end{tabular} \\ \hline KNN & 91.23 & 90.61 & 0.88 & 0.802 & 0.033 & 9.46 & \begin{tabular}{c} n\_neighbors = 161, p = 2, \\ metric = ‘euclidean’ \\ \end{tabular} \\ \hline DT & 96.43 & 95.31 & 0.96 & 0.93 & 0.45 & 0.006 & \begin{tabular}{c} max\_depth = 5, random\_state = 0 \\ \end{tabular} \\ \hline MLP & 91.22 & 91.13 & 0.89 & 0.81 & 59.26 & 0.026 & \
\begin{tabular}{c} random\_state = 0, max\_iter = 200, \\ alpha = 1 \\ \end{tabular} \\ \hline CNN & 97.81 & 90.09 & 0.84 & 0.96 & 1800.59 & 157.22 &
\begin{tabular}{c} Conv2D(64,(3,3), strides = (2,2), \\ padding = ‘same’, \\ input\_shape(2,3,3), \\ activation = ‘relu’ \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Findings from the five classification algorithms applied to the CICDDoS2019 dataset. accuracy (96.43%), prediction accuracy (95.31%), F1-Score (0.96), and training time (0.45 s) are superior in our test. As a result of this comparison between our testbed and the testbed used in the literature review, even though the dataset and test environment are different, our test in this study still achieves a high level of accuracy, F1-score, and training time when compared to the results from the prior literature. This is due to synchronization, algorithmic tuning parameters, and the type of dataset that we used when training the model, as well as other factors. Additionally, we take into account in our simulation the prediction side because [11] is the only literature study that mentions this computation side. In order to evaluate the model's effectiveness in the speed detection process, we computed the accuracy as well as the timing for both training and prediction--calculations that were not included in the previous literature reviews. As a result, we included time calculations in our analysis.