# Comparison of ML/DL Approaches for Detecting DDoS Attacks in SDN
## 6 Conclusions  
SDN leads to network changes by redefining network administration and connectivity. Even though SDN has many advantages, it also introduces new security concerns that demand academics/industry. DDoS assaults can affect both the SDN controlplane as well as the dataplane. The identification of DDoS attacks is more difficult today than it was in the old network due to the complexity of traffic flow features. We may create a novel strategy for characterizing DDoS assaults in an elastic technique owing to a decoupled SDN architecture. To ensure the accuracy of the attack definition, the behavior of DDoS assaults in the SDN must be examined in novel contexts. ML/DL might be a creative approach that integrates with SDN as a novel development for assisting people in making choices athwart various domains. In this study, we used datasets (CICIDS2017 and CICDDoS2019) that cover several current attack types. The datasets include 79 features and 6 different types of attack. Five classification approaches (SVM, KNN, DT, MLP, and CNN) were used to train the datasets and test the results. In order to make classification easier, the processed  
Figure 11: Models accuracy comparison result. Figure 12: Models’ F1-score comparison result. Figure 13: Models’ timing comparison result. datasets contain varying percentages. According to the results of this study, among the different algorithms employed, CNN had the maximum train accuracy (A) (95.18%) and prediction accuracy (89.61%) using the CICIDS2017 dataset, and it had a training accuracy of 97.81% and prediction accuracy of 90.09% by using the CICDDoS2019 dataset, and it can be noted that in both datasets, there is a large difference between the training and prediction in terms of accuracy using CNN because the CNN needs a huge dataset for training to increase the accuracy of the prediction. Additionally, it ban be noted that SVM achieves a good accuracy rate (i.e., accuracy rate between the training and prediction) in both datasets compared with CNN and other algorithms. Finally, it can be noted also that CNN has a high training and testing time compared with other algorithms, and this goes back to deep learning in general, and CNN specifically uses an image dataset to build the model, so converting the non-image data to image data adds an additional time process. So, this indicates that the SVM can correctly and simply detect DDoS assaults. So there is potential for improvement, and the model might be tuned to function more effectively in terms of accuracy rate and time for the training and testing model. Additionally, just one day's worth of DS from different days was used for this investigation. As a consequence, it is clear from our test that we performed better than expected in terms of accuracy, F1-score, MCC, and timing when compared to earlier literature reviews. This improvement may be attributed to the kernel type, the device used to conduct our simulation, and the tuning parameter. Additionally, there is room for development, and the model may be adjusted to work more efficiently. Additionally, we can observe that the ML/DL model performs better when utilizing the CICDDoS2019 dataset since it has the most recent information on a wide variety of attacks. As a result, the model requires constant refeeding with UpToDate features to optimize its learning. As a result, it is possible to create one's own dataset in the future that includes various attack types and UpToDate characteristics to raise the degree of model learning. On the other hand, our study's limitation is that we were only able to analyze data from one day's worth of DS from several days. Therefore, it is crucial to use the entire dataset, which contains a total of six different types of assaults, in order to draw a clear conclusion. Additionally, simulation and offline analysis form the foundation of our work. Due to this, assessing the effectiveness of detection algorithms in real-time and on actual networks is challenging.