# Comparison of ML/DL Approaches for Detecting DDoS Attacks in SDN
## 5 Discussion and Result  
It appears that using the different datasets (CICIDS2017 and CICDDoS2019) gives approximately the same values, and it can be noted that there is a light improvement in the performance values by using the CICDDoS2019 dataset. Additionally, we can note that SVM and MLP have better accuracy performance in both training and prediction steps. In contrast, CNN has a big difference in the performance of accuracy between training and prediction, and this is because CNN needs a large dataset to feed the model to increase the prediction accuracy rate. According to DT, it has an acceptable accuracy rate, but instability can result from a bit of change in the data, leading to a substantial change in the DT structure. When compared to other algorithms, DT calculations can occasionally become significantly more complicated. Additionally, we can note that SVM has better performance in terms of F1-score, which means the SVM classifier works best because it has higher precision and recall compared with other algorithms. Finally, in terms of the training and prediction time, we can note that CNN has the highest time in (reprocessing, training, and prediction) phases and this goes back to CNN working with image data, so we need to transform the non-image data to image data. This takes a long time during our test in both training and prediction also because it uses auto-select features, which also take time during the process, as well as going back to using multiple convolution layers and then inserting the data to flatten the input layer, multiple hidden layers, and then the output layer to build the model. Figures 7 and 8 show the accuracy and time for our test result for both the training and prediction model. Figure 6: CM for binary classification. Also, Figures 9 and 10 show the result of MCC and F1-Score by using both CICIDS2017 and CICDDoS2019 datasets. The outcomes of our employment of several ML/DL algorithms are displayed in Tables 2 and 3 for both the CICIDS2017 and CICDDoS2019 datasets. In both tables, there is not a big difference in the results when using different datasets. Additionally, we can note that CNN has the highest training accuracy (97.81%), while the performance of prediction accuracy is the lowest (90.09%). Additionally, the SVM has a very similar accuracy rate in both training and prediction (95.08% for training and 95.57% for prediction), as well as the MLP (91.22% for training and 91.13% for prediction). In addition, in both tables, we can note that KNN has the lowest accuracy in both  
Figure 8: Models’ time result. Figure 10: Models’ MCC result. Figure 7: Models’ accuracy result. Figure 9: Models’ F1-score result. (90.41% for training and 89.16% for prediction). According to the training and prediction times, we can note that CNN takes a long time in both training and prediction steps, while DT is a lower value. According to the F1-score, we can note that SVM has a higher value (0.97), while CNN has the lowest value (0.84). Tables 4-7 lists a comparison between our study result and the previous literature study using various datasets. It is important to note that each work's performance is based on a unique dataset with distinct features, so the goal of the comparison between the various prior reviews of the literature and our result study is to show which output, when using particular training, a prediction strategy, a unique dataset and testbed hardware, produces the best results. As we can see, in the training stage, the SVM from the literature study has the greatest accuracy (94.59%) in [16]; however, in our test, it has 95.08%. Additionally, only the prediction stage in [11] was computed with 93.4%, although in our test, it had 95.57%. The best result for the F1-score is 0.9142 in [13]; however, it is 0.97 in our test.