[PERSON]  
3 EIAS: Data Science and Blockchain Laboratory, College of Computer and Information Sciences, Prince Sultan University, Riyadh 11586, Saudi Arabia; [EMAIL_ADDRESS] (A.A.A.A. can be accessed via the control plane. However, the control plane consists of several hardware devices, such as switches and routers, as well as firewalls. These devices run complex protocols and operating systems or firmware to efficiently perform their tasks [5]. Handling of these devices is a difficult task due to non-compliance of conventions by hardware vendors, inconsistencies in policies, and scalability issues. These complexities are quite challenging and result in network management and performance issues. The answer is to redefine networking to support more protocols and applications by having a network paradigm where network controls are programmable. SDNs fulfill these requirements with simple, easy, and effective networking. In an SDN, the entire network is logically centralized through a network operating system (NOS). The NOS acts as a layer between the forwarding devices and network applications. The former consists of hardware devices, while the latter is software designed to enforce particular behavior on the network (see Figure 1). In other words, the operating system acts as a layer between different types of software and the hardware required to run that software. However, this centralization leads to higher vulnerability to DDoS attacks. The DDoS attack is basically a flood of bogus requests which confines the network traffic, thus immobilizing the network. The attack is usually done via bots, which can be computers or other IoT devices set to go off at a particular time. A diagrammatic representation of the architecture of DDoS attack is given in Figure 2. To understand the magnitude, Amazon was hit by a DDoS attack on the scale of 2.3 Tbps in the first quarter of 2020 [6]. For an organization that operates 24/7 across the globe, such attacks have severe financial repercussions. Figure 1: Architecture of a software-defined network. Due to the vulnerability of SDNs, a notable amount of research has been carried out in the past few years with regard to the use of machine learning (ML) and deep learning (DL) for DDoS attack detection [8]. The well-known techniques used by researchers for the DDoS detection problem include K-nearest neighbors (KNN), decision tree (DT), ensemble learning (EL), random forest (RF), support vector machine (SVM), and artificial neural networks (ANNs). A detailed discussion of these algorithms can be found in [PERSON] et al. [9]. Table 1 presents a summary of several recent studies. One obvious limitation that is highlighted by the summary regards to the datasets used; there are no viable or realistic datasets that are particularly developed for SDN attacks, and the datasets developed by individual researchers are also not available publicly, and hence cannot be used for benchmarking. These observations are also confirmed by several past studies [10; 11; 12; 13; 14]. For example, studies have used general datasets such as KDD-Cup99 [15; 16; 17; 18; 19; 20], CICIDS 2017 [21; 22; 23], CICIDS 2018 [23; 24], CIC-DDoS 2019 [21; 23; 25; 26; 27; 28; 29], and others [9; 22; 30; 31]. Furthermore, although several studies [1; 2; 11; 15; 19; 32; 33; 34; 35; 36; 37; 38; 39; 40] have used SDN-specific datasets, there are only two reported studies that have made their comprehensive dataset available in the public domain. The first is the InSDN dataset proposed by [PERSON] et al. [2], which has been used in other studies [29; 33; 35; 39]. The second dataset was proposed recently by [PERSON] et al. [1], who carried out an in-depth analysis of DDoS attack detection in SDNs using their proposed dataset.