# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 5 Available Benchmarked DDoS Datasets and Classes of Attacks in Datasets
**CSE-CIC-IDS2018:** in 2018, the Communications Security Establishment (CSE) and the CIC collaborated to generate this dataset by creating user profiles that include an abstract depiction of many occurrences. All of these profiles were then integrated with a special set of characteristics to create the dataset. Brute Force, Heartbleed, Botnet, DoS, DDoS, Web assaults, and network penetration from within are just a few of the seven various attack scenarios that are covered by this dataset [84]. **ISCX2012:** this of dataset, which contains full-packet network data, was developed in 2012 by [PERSON] et al. [20] It covers seven days from June 11 to June 17, 2010, with network activity including both legitimate and malicious traffic. A few examples of malicious traffic include Distributed Denial of Service, HTTP Denial of Service, and Brute Force SSH. This dataset was produced in a simulated network context, and contains labeled and unbalanced data. Two broad profiles, one that describes attack activity and the other that describes typical user scenarios, are utilized in the ISCX dataset [85]. **CICDDoS2019:** [PERSON] et al. [86] created the CICDDoS2019 dataset (2019). More than 80 traffic characteristics were taken from the original information by using the CICFlowMeter-V3 program to extract the features. The CICDoS2019 contains typical DDoS assaults that are safe and current. This dataset, which was created using actual traffic, contains a variety of DDoS assaults created utilizing TCP/UDP protocols [87]. Preprocessing Techniques, Hyperparameter Settings, Experimental Configurations, and Performance Metrics  
Table 4 lists the preprocessing techniques, hyperparameter settings, test configurations, and performance metrics employed by the current ML/DL algorithms for DDoS attack detection. At the beginning, the data are preprocessed. Preprocessing the data is essential, as it changes raw data into a structure that improves the model's capacity for learning [88]. Table 5 in this research provides an overview of preprocessing techniques employed in the body of the literature. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Ref.** & \begin{tabular}{c} **Preprocessing** \\ **Strategies** \\ \end{tabular} & \begin{tabular}{c} **Hyperparameter Values** \\ \end{tabular} & \
\begin{tabular}{c} **Experimental** \\ **Setups** \\ \end{tabular} &
\begin{tabular}{c} **Performance Metrics** \\ \end{tabular} \\ \hline [PERSON] et al. [43] & ELM with a BAT & Accuracy = 99.3\%, Sensitivity = 99\%, Specificity = 99\%, Precision = 99\%, F1-score = 99\%, FPR = 1\%, FNR = 1\% \\ \hline [PERSON] et al. [44] & NDAEs with RF & Built-in TensorFlow & 98.81\%, saving time and improving accuracy by up to 5\%. \\ \hline [PERSON] et al. [47] & CNN, AE, and RNN & Accuracy for DCNN and LSTM of 85\% and 89\%, respectively. \\ \hline [PERSON] et al. [48] & AE technique & Improved SVM Classification accuracy and time \\ \hline [PERSON] et al. [49] & Multi-layer ensemble SVM & Hadoop cluster & Enhanced IDS performance. \\ \hline [PERSON] et al. [50] & MSML & MSML was superior to other current intrusion detection algorithms in terms of accuracy, F1-score, and capacity. \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The most recent studies on DDoS attack detection using ML/DL.