Which features from InSDN dataset were used in experiments?

[Keisuke2]

Hi,
Thanks for sharing this interesting work! I have a quick question about the experimental setup.
Your paper mentioned that the InSDN dataset was used as training data, but I was wondering which specific features from the dataset were actually used in the experiments?
Any clarification would be very helpful.
Thanks in advance!

[vanlalruata]

Kindly go throught the controller_dl.py file.

[Keisuke2]

Thanks for the pointer to controller_dl.py.
I noticed that the flow_training() function uses FlowStatsfile.csv, but your paper mentions using the InSDN dataset. Are these the same dataset, or is there a discrepancy between the paper and the implementation?
Thanks!

[vanlalruata]

The model training is with InSDN, save the model, for implementation, load the model inside the controller, monitor each flow, if found crossing the predicted threshold then mark as attack, that is from the real traffic. Two different data....is used... In simple, for training model, InSDN. Validating the traffic, real traffic within the sdn environment. With Regards, *Dr. Vanlalruata Hnamte*

…

On Thu, 3 Jul, 2025, 4:22 pm Keisuke, ***@***.***> wrote: *Keisuke2* left a comment (vanlalruata/DDoS-attack-detection-and-mitigation-using-deep-neural-network-in-SDN-environment#5) <#5 (comment)> Thanks for the pointer to controller_dl.py. I noticed that the flow_training() function uses FlowStatsfile.csv, but your paper mentions using the InSDN dataset. Are these the same dataset, or is there a discrepancy between the paper and the implementation? Thanks! — Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AE5QSPETSEBRBVU3XJPZSMT3GUDN5AVCNFSM6AAAAACAWJ2XEGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTAMZRHAYTANZTGA> . You are receiving this because you commented.Message ID: <vanlalruata/DDoS-attack-detection-and-mitigation-using-deep-neural-network-in-SDN-environment/issues/5/3031810730 @github.com>

[vanlalruata]

Is there a discrepancy between the paper and the implementation? No. There are lots of tests around, and we dump all the tests and don't get confused with that. You can follow the paper's algorithm, and set up to implement the same. FlowStatsfile.csv is just the dump traffic flow....For simplicity, we call in the flow training once again to see any differences. That is out of the scope from the paper infact.... We had never mentioned the FlowStatsfile.csv in the paper.

…

On Thu, 3 Jul 2025 at 16:22, Keisuke ***@***.***> wrote: *Keisuke2* left a comment (vanlalruata/DDoS-attack-detection-and-mitigation-using-deep-neural-network-in-SDN-environment#5) <#5 (comment)> Thanks for the pointer to controller_dl.py. I noticed that the flow_training() function uses FlowStatsfile.csv, but your paper mentions using the InSDN dataset. Are these the same dataset, or is there a discrepancy between the paper and the implementation? Thanks! — Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AE5QSPETSEBRBVU3XJPZSMT3GUDN5AVCNFSM6AAAAACAWJ2XEGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTAMZRHAYTANZTGA> . You are receiving this because you commented.Message ID: <vanlalruata/DDoS-attack-detection-and-mitigation-using-deep-neural-network-in-SDN-environment/issues/5/3031810730 @github.com>

-- With Regards, *Dr. Vanlalruata Hnamte*

[Keisuke2]

Thank you for the clarification!
Following up on your suggestion to implement according to the paper's algorithm - could you specify which features from the InSDN dataset were used for pre-training the model? Should I assume the same feature set as used in controller_dl.py (excluding 'flow_id', 'ip_src', 'ip_dst')?
Thanks!

[vanlalruata]

Yes, that is right. As 'flow_id', 'ip_src', 'ip_dst' are not important for our model.

[Keisuke2]

Thanks for confirming the feature exclusion.
I noticed that the InSDN dataset has very different features compared to controller_dl.py. InSDN has 80+ features (Flow IAT, Packet Length stats, TCP Flags, etc.) while controller_dl.py collects only ~20 basic features.

For the InSDN pre-training:

• Should I also exclude controller-specific features like 'datapath_id', 'timestamp'?
• How do you handle the feature mismatch between InSDN (80+ features) and the real-time data collection (20 features)?
• Do you extract the same 20 features from InSDN, or use a different feature mapping approach?"

Thanks in advance.