## 2 Related Work  
DDoS attacks have been well investigated for SDN networks, where the target of DDoS attackers may be the control plane or data plane, compromising the controller or SDN switches, respectively [10; 11]. In this section, we provide a review of DDoS attacks on SDN in Tables 1 and 2 followed by a review of security concerns of SDN-based IoT networks. \begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Algorithm** & **Simulation** & **Real Imple-mentation** & **Detection or Defence** & **Control or Data Plane** & **Advantages** & **Disadvantages** \\ \hline [PERSON] et al. [12] & \(\checkmark\) & \(\checkmark\) & Both & Both & Feasible and accurate in the small network. & Resource consumption is high when confronting mature attacks. \\ \hline [PERSON] et al. [13] & \(\checkmark\) & \(\checkmark\) & Detection & Both & Low resource consumption and short detection time. & Hard to define the threshold of detection for different applications. \\ \hline [PERSON] et al. [14] & \(\checkmark\) & \(\checkmark\) & Detection & Control Plane & Prompt and accurate, improvement in false positive and false negative issues. & No simulation or implementation related to SDN. \\ \hline [PERSON] et al. [15] & \(\checkmark\) & \(\checkmark\) & Both & Data Plane & Low false positive. & High latency, especially for the users sharing the same port with the attacker. \\ \hline [PERSON] et al. [16] & \(\checkmark\) & \(\checkmark\) & Both & Control Plane & Further inspection to decrease false positive. & Produce delay to legitimate users. \\ \hline [PERSON] et al. [17] & \(\checkmark\) & \(\checkmark\) & Both & Both & Able to protect the flow table on the switch. & Hard to define key parameters, such as peak time. \\ \hline [PERSON] et al. [18] & \(\checkmark\) & \(\checkmark\) & Detection & Data Plane & High detection rate and low false positive. & Hard to define key parameters, such as abnormal link utilisation. Limited to link flooding attacks. \\ \hline [PERSON] et al. [19], [PERSON] et al. [20] & \(\checkmark\) & \(\checkmark\) & Detection & Control Plane & High accuracy and low false positive. & Performance is based on the training dataset. \\ \hline [PERSON] et al. [21] & \(\checkmark\) & \(\checkmark\) & Both & Data Plane & Capable of localising attackers and transformable countermeasures. & Hard to define the metric and threshold. \\ \hline [PERSON] et al. [22] & \(\checkmark\) & \(\checkmark\) & Detection & Data Plane & Effective and scalable. & Require extra device and interface. \\ \hline [PERSON] et al. [23] & \(\checkmark\) & \(\checkmark\) & Both & Control Plane & Associate multiple controllers instead of extra devices to mitigate DDoS attacks. & High-frequency attack may result in continual leader controller election. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Existing solutions for detecting and defending Software-Defined Networking (SDN) against Distributed Denial of Service (DDoS) attacks. \begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Algorithm** & **Simulation** & **Real Implementation** & **Detection or Defence** & **Control or Data Plane** & **Advantages** & **Disadvantages** \\ \hline \hline [PERSON] et al. [24] & ✓ & ✗ & Both & Data Plane & Allows inter-domain defence of DD6 attacks. & Attacks with spoofed IP address will make controllers block normal users. \\ \hline [PERSON] et al. [25] & ✓ & ✓ & Defence & Data Plane & The collaboration between the controller on the customer side and ISP side enables quick response to DDoS attacks. & The link between ISP controller and customer controller consumes a new threat in this model. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Cont.