## 1 Introduction  
SDN is among the most innovative communication technologies developed and will eventually replace conventional networks in managing network traffic flows. In addition, SDN assists data centers in controlling costs by boosting network traffic management efficiency and entirely controlling network features to meet ever-changing network business needs by isolating the data layer from the control layer [1]. The controller allows applications to develop programmes to manage network flow [2]. SDN has many advantageous features, such as network programmability, enabling the fast deployment of SDN networks, and dynamic management. In contrast, traditional networks take longer to deploy and face challenges in meeting requirements to add a new host to the network [3, 4]. Figure 1 compares SDN and a traditional network architecture. The controller is an essential feature of the SDN architecture, which is responsible for controlling the entire network operations through persistent monitoring of network devices and routing network traffic flow by generating new rules or modifying existing table instructions in the switch according to new incoming packet features and the packet flow behavior [5]. Further, an SDN controller has proactive or reactive modes to deal with network traffic packets. In their attempt to secure an SDN network from DDoS attacks,researchers [6] have discovered that preinstalling rules in the switch table to process incoming packets in a proactive mode has a more significant effect on SDN performance than a reactive mode. In contrast, in a reactive mode, rules are created and installed inside a switch table whenever incoming packets match the switch table's rules [7]. Additionally, the controller has various roles, employing different modules to collect statistical information concerning network traffic and identify tasks for each network component [8]. Furthermore, an SDN controller gathers the required information from the network packets and then applies additional analysis to discover DDoS attacks. Nonetheless, a centralized controller has challenges and issues that affect network performance in terms of security, reliability, and scalability [9]. The integration of an SDN controller in the network could potentially bring many new security challenges, especially when the centralized controller acts as an operating system. Any unaddressed threat to the centralized controller may lead to a network breakdown. For instance, in DDoS attack scenarios, the attackers flood a network by sending a massive number of spoofed IP packets to the controller, thereby congesting and overwhelming the controller, resulting in the exhaustion of network resources and the collapse of the entire SDN networks [10]. Because security is an essential feature of any network, coupled with the importance of SDN controllers in the SDN architecture, network security has received much attention from network security researchers [11]. Although SDN offers several advantages that contribute to protecting a network from malicious attacks, its flexibility and programmability attract the attention of adversaries seeking to disrupt or destroy the network by targeting the SDN controller [12]. This paper evaluates the effectiveness of the entropy-based DDoS attack detection method, focusing on the ability to detect attacks with varying attack traffic rates (such as a high attack traffic rate and a low attack traffic rate) targeted directly at the controller and triggered by a single or multiple attack hosts that target a single or multiple victims. Security challenges in SDN are increasing, specifically in a controller. A DDoS attack is among the most dangerous attacks that could threaten an SDN controller [13] due to its ability to cripple an entire network.