InSDN-8

We proposes a set of standard features of ML-based DDoS detection in SDN environments using full-featured InSDN dataset.

The standardization of a feature set is expected to bridge the gap between research and the practical application of ML-based DDoS detection systems. The feature-selection process identified the most commonly used metrics across eight key studies in the field. Only those features appearing in at least four of the eight reviewed studies were retained to ensure broad consensus and effectiveness. The resulting standardized set comprises eight features: Protocol [6], Flow Duration [28], Flow IAT Max [41], Bwd Pkts/s [79], Pkt Len Std [25], Pkt Len Var [26], Bwd IAT Tot [34], and Flow Pkts/s [77].