## 3 Proposed Architecture: Multi-Model IDS Based on Traffic Load
### Motivation Behind Using Centralized Network Architecture Approach  
Network architectures with a centralized architecture can significantly impact the performance of IDSs that utilize ML algorithms. By implementing a centralized architecture, security threats can be detected more accurately due to improved visibility and control. As a result of the centralized control plane, IDSs based on ML can collect and analyze network data from a wide range of devices to detect anomalous behavior and potential threats [50]. In addition, centralized architectures allow for the uniform enforcement of security policies across the network, reducing the risk of misconfigurations or inconsistencies that may result in false positive alerts from the IDS. By defining and distributing security policies across all network devices, the central controller ensures consistent protection against cyber threats [51]. Moreover, security incidents or breaches can be responded to more rapidly if the network is centralized. By isolating compromised devices, implementing remediation measures, and identifying the affected network areas, the central controller can quickly respond to the affected network areas. By implementing centralized control, security incidents can be responded to more efficiently and effectively, minimizing their impact [51]. In contrast to decentralized network architectures, multiple controllers can present additional challenges in managing and coordinating. Keeping ML-based IDS performing efficiently and effectively can be challenging when it comes to ensuring consistent policy enforcement and efficient communication between controllers and network devices [52]. Furthermore, decentralized architectures may result in additional overhead associated with communication and coordination between controllers, potentially impeding the performance of ML-based IDSs [53]. Decentralized and centralized network architectures are distinct approaches to managing computer systems, networks, and data storage. In centralized network architectures, these networks have the following key differences: a hierarchical structure, which is controlled and managed by a central authority; a single point of failure, which can lead to data breaches, data outages, and censorship; data stored in a central location, resulting in vulnerabilities and privacy concerns; and limited scalability and performance, as the central authority struggles to manage the growing number of data and users [54]. With a decentralized network architecture, a flat structure, where no single entity controls the entire network, increases security and privacy, since data are stored in multiple nodes, increasing its resilience to attacks and censorship and improving its scalability and performance, as it can adapt to an increased number of users and data storage, as well as reducing reliance on a central authority, which can improve the network's overall resilience [54]. Therefore, centralized and decentralized network architectures can benefit from ML-based IDSs, but the choice will depend on the network's specific requirements and constraints. While decentralized architectures provide better privacy and resilience, centralized architectures may provide enhanced security and control [54; 55]. A summary of the advantages and disadvantages of centralized and decentralized network architectures can be found in Table 4. Related works also support the use of centralized network architectures, as shown in the SDN Models subsection of Related Work, where accuracy is consistently greater than 95% in all mentioned studies. SDNs represent an evolving version of the centralized network architecture principle.