## 5 Vulnerabilities of SDN to LDDoS Attacks
### Classification-Based LDDoS Detection
After evaluation and selection, the dominant individuals are retained in the next generation. After several iterations, the individual with maximum fitness is identified as the best individual. Then the best individual in the corresponding feature set is decoded. Furthermore, to verify the detection ability of the optimized feature subset, eight different classifiers have been applied to evaluate the feature optimization methods (SVM, NB, LR, DT, C4.5, RF, and AB). The experimental results showed that DIAMOND has 92% accuracy in detecting LDDoS attacks from the controller view of network traffic and can effectively identify low-dimensional feature groups to improve the performance of the LDDoS detection method. In [83], [PERSON] et al. proposed a lightweight real-time Performance and Features framework to detect and mitigate LDoS attacks in an SDN environment. They implemented LDoS attacks in SDN, extracted traffic features using OpenFlow, divided all extracted traffic features into attack performance and attack features, and classified them into two categories. By analyzing the performance of normal traffic in the attack state, performance-based detection determines whether LDoS attacks will be effective by building machine learning models with normal and abnormal network state traffic features. Feature-based detection attempts to figure out the LDoS attack flow based on time-frequency analysis. Potential attack flows can be found by analyzing the morphological characteristics of LDoS attack flows with OpenFlow messages and flow table queries. Once the performance and features model ensures that the attack will take effect while the performance and features model detects the LDoS attack flow, the mitigation method is activated. The Performance and Features model locates the attackers' source IP and the victims' ports. Then it sends a defense rule according to the location result to filter the LDoS attack traffic. The authors conduct online and offline experiments to mitigate attacks on the SDN controller. The experimental results show that the proposed method achieves 96% accuracy in detecting LDoS attacks. The proposed framework can also mitigate LDoS attacks in real-time in an average time of 9.39 s with 0.02 to 0.04 CPU and low memory consumption. In [80], [PERSON] et al. proposed a flow-based detection and mitigation framework using machine learning as a classifier to detect LDDoS attacks. The authors extracted the basic attack detection features such as flow duration, number of packets, the relative distribution of packet interval, and relative distribution of matched bytes using a flow management module. The mitigation phase is then performed, where the attack flow information is processed and mitigation rules are checked to avoid an LDDoS attack from the same source. To detect LDDoS attacks by examining the features extracted from the stream management module, the authors applied a machine learning model with SVM, Naive Bayes, and a Decision Tree. They used the Scikit-Learn 0.23 library to classify the malicious traffic by using the output of the flow management module as input to the model. The mitigation phase is alerted to further process the attack packets when attacks are detected. After analyzing the traffic characteristics, the machine learning models return a value of 0 for regular traffic and 1 for attack traffic. The model forwards the corresponding source IP address to the blocklist table via the detection module as soon as the traffic is identified as malicious, i.e., when it is assumed that it might be an attacker. The mitigation module then alerts the OpenFlow switch to prevent the given stream by immediately creating a port blocking rule. In this manner, the authors hope to match the source IP address of each data stream with the entries in the blocking list table before redirecting them for further operation so that the installed traffic control rules remove them from the flow table after seven days. This process should help to analyze and update the data flow on a regular basis.