# Machine Learning Techniques to Detect a DDoS Attack in SDN: A Systematic Review
## 3 Most Up-to-Date ML/DL Techniques for Detecting DDoS Attacks
* **Ensemble methods:** the main idea behind ensemble techniques is to learn in an ensemble fashion in order to benefit from the use of multiple classifiers. Each classifier has its own advantages and disadvantages; for example, they may be good at spottinga certain kind of attack and bad at spotting other kinds. By training several classifiers, ensemble techniques can combine several weak classifiers to create a single stronger classifier, which is typically selected using a voting mechanism [27]. DL is a type of ML used in AI that has the ability to learn from both supervised and unstructured data [28]. DL models are known as Deep Neural Networks or Deep Neural Learning, as the technology makes use of multi-layer networks. Neurons connect the levels and stand in for the mathematical calculations behind learning processes [29]. As seen in Figure 3, the three main processes that make up most ML/DL methods are: **(i)** the data preparation phase, **(ii)** te training phase, and **(iii)** the testing phase. The dataset is initially preprocessed for each of the suggested solutions in order to convert it into a form that the algorithm can use. Typically, this phase involves normalization and coding. The dataset may need be cleaned, which occurs during this step if necessary. Duplicate entries and entries with missing data are removed. The training dataset and testing dataset are created by randomly dividing the preprocessed data into two halves. Typically, nearly all (80%) of the initial dataset size is typically made up of the training dataset, with the remaining amount (20%) constituting the testing dataset. In the subsequent training phase, the ML or DL algorithm is taught using the training dataset. The proportion of the dataset that is used and the complexity of the model being trained affect how long it takes the algorithm to learn. Due to their intricate and sophisticated structure, DL models often require a longer training period than ML models. After training, models are tested using the testing dataset, with performance being assessed based on the predictions made by the model. In the case of DDoS detection models, this takes the form of network traffic instances being classified as either benign (normal) or attack instances. DL techniques can be divided into five groups: hybrid learning, semi-supervised learning, supervised instance learning, and supervised sequence learning. A succinct summary of each category is provided below:  
**Supervised instance learning:** Supervised Instance I = Learning uses the flow of instances [18]. For training purposes, it makes use of labeled instances. The most popular techniques in this area are:  
* **Deep Neural n = Networks (DNN):** a fundamental DL structure that allows the model to learn at multiple levels. It comprises several hidden layers, along with input and output layers. DNNs are used to simulate complex nonlinear functions. The addition of more hidden layers improves the model's abstraction level, expanding its potential. For classification purposes, the output layer consists of one fully connected layer and a softmax classifier. The Rectified Linear Unit (ReLU) function is commonly used as the activation function for the hidden layer [30; 31]. Figure 3: Methodology for generalized machine learning/deep learning-based DDoS detection systems. * **Convolutional Neural Network (CNN):** a CNN is a DL structure that is well suited for image and signal data. All CNNs have an input layer, a stack of convolutional and pooling layers for feature extraction, a fully connected layer, and a softmax classifier in the classification layer. CNNs have achieved great progress in the realm of computer vision, and can perform supervised feature extraction and classification functions for DDoS detection tasks [32]. **Supervised sequence learning:** in supervised sequence learning, a series of flows are used; when learning from a set of inputs, this form of model keeps track of the prior input states in its memory.