DDoS-SDN-Tree-MultiClass

This investigation elevates the analytical depth by not merely differentiating between normal and malicious traffic but by further discerning the intensity of DDoS attacks, classifying them as either "weak" or "strong." The classification schema is meticulously designed, with traffic categorized into three distinct labels: Normal (Label = 0), DDoS Attack Weak (Label = 1), and DDoS Attack Strong (Label = 2), thereby enabling a nuanced understanding of attack dynamics and their implications.

The research framework is adeptly aligned with the operational nuances of the Mininet emulator, tailored for SDN scenarios, and encompasses comprehensive descriptors of network behavior including packet rates, sizes, and types, alongside flow quantities and protocol specifics. This structured approach not only facilitates the application of supervised learning methodologies but also underscores the study's commitment to a detailed investigational analysis.