## 2 Related Work  
As a new network paradigm that provides agility and programmability, SDN attracts research in industry and academia worldwide. [PERSON] et al. [PERSON] et al. (2016) proposed a hybrid approach to detect DDoS attacks in SDN using two main modules: (1) the initial detection module that uses the information entropy to detect attack traffic and (2) the detection module that uses the stacked sparse autoencoder and support vector machine classifiers to validate the attack traffic. The proposed hybrid approach may not be able to detect combined multiple unknown DDoS attacks. [PERSON] et al. [PERSON] et al. (2017) proposed a new approach to detect and protect the SDN-based supervisory control and data acquisition (SCADA) systems against DDoS attacks. The proposed approach uses two parallel neural networks including long short-term memory (LSTM) and gated recurrent units (GRU) to detect the DDoS attack. They also use SVM to classify the extracted features from the network traffic. This approach has two limitations: First, it may cause computational overhead when it applies to a real-life environment since it uses three machine learning classifiers to detect malicious traffic and classify traffic features. Second, the detection time required by three classifiers will be long, which may enable the attack traffic to overwhelm the entire SDN environment. [PERSON] et al. [PERSON] et al. (2018) discussed the possibility of adopting machine learning approaches in SDN to detect DDoS attacks. However, this work did not go so far as to investigate potential approaches that can be used to detect OpenFlow switches targeted by known and unknown saturation attacks. [PERSON] et al. [PERSON] et al. (2018) presented a multi-vector DoS attacks using the stacked autoencoder (SAE). It processes all received packets for flow computation and attack detection, which requires extensive computational resources, instead of flow sampling. [PERSON] et al. [PERSON] et al. (2018) introduced a detection system for DDoS attacks by adopting the Dirichlet process mixture model. With this system, the misclassification rate of the attack traffic is around 50%. [PERSON] et al. [PERSON] et al. (2018) introduced the FDAM system to detect and mitigate ICMP, SYN, and UDP flooding attacks. The FDAM detection method uses the SVM classifier to detect these attacks and a white-list approach to block the malicious traffic. The main shortcoming of the FADM detection method is using the SVM classifier, which cannot detect unknown saturation attacks and requires a long training and prediction time. [PERSON] et al. [18] introduced a DoS detection system by using the deep neural network (DNN). The accuracy of the proposed detection model is 88.04%, which is relatively low. The proposed system was trained and tested by the NSL-KDD dataset, which is generated by traditional network traffic. [PERSON] and [PERSON] [15] detected the attack flows by using a neural network. They used the NSL-KDD to train and test the proposed system. [PERSON] et al. [19] adopted the self-organized map (SOM) to develop a lightweight detection system for DDoS flooding attacks against SDNs. The proposed system collects all OpenFlow switches flow entries to extract the SOM classifier features to detect DDoS attacks. Thus, the features extraction process requires a long processing time which may enable the attacker to flood the network. [PERSON] et al. [20] used a trained SVM classifier to detect SYN, ICMP, and UDP attacks. The proposed system includes (1) flow state collection method that is responsible for collecting the flow-table states of the OpenFlow switches, (2) characteristic values extraction to extract the classifier features, and (3) classifier judgment that uses the SVM classifier to detect the attacks. This work represents a simple method for detecting some flooding attacks in SDNs. [PERSON] et al. [5] proposed LineSwitch, which is an OpenFlow module that can be deployed to OpenFlow switches to countermeasure SYN flooding attacks based on probability and blacklisting.