## 2 Related Work
### Security in SDN-Based IoT Networks  
As explained in the previous section, DDoS attacks in SDN, though a well-investigated topic, still require attention to improve DDoS detection and mitigation. One of the biggest challenges in the IoT network is also security, because of the vulnerabilities in IoT devices [33]. If we combine SDN with IoT networks, it could be a potential solution to improve the security feature in the IoT network, especially against DDoS attacks [34]. [PERSON] et al. [26] propose an SDN-based architecture, called SPF, to alleviate the burst of information in IoT, which is similar to the DDoS attack scenario. Data plane in the SDN is replaced by a processing and dissemination plane, which contains a programmable module. Instructions from the SPF controller are received through this module. The processing module filters requests from user application by the type of service, and then sets the priority as a reference for dissemination. Smart decisions are made on the basis of the knowledge of SDN controllers. [PERSON] et al. [27] utilize a scheme, called Edge-Centric Software-Defined IoT Defence (ECESID), to detect and mitigate DDoS attacks on the edge node of IoT network. The detection phase is based on the hypotheses that (i) a benign connection is more likely to succeed than a malicious one, and (ii) the frequency of connection requests from an infected host is much higher than from a normal host. Thus, from the record of connection attempts and failure counts within a given period, a host can be defined as infected or not. Then, updated flow rules are inserted from the SDN controller to the switch to block all the flows originated from that malicious host. [PERSON] et al. [28] propose a mechanism based on trust level of users to protect SDN controller against DDoS attacks in the IoT paradigm. Each user in the network is assigned a trust value refer to its history record, and a higher trust value means the controller gives a higher priority on the request, while a low trust level could lead to discarding packets from that user. Moreover, the controller has a buffer to queue requests, if this buffer is also overwhelmed, the request with the lowest trust level is dropped to make room for a more trustworthy inquiry. [PERSON] et al. [29] involve semi-supervised machine learning algorithms to detect DDoS attacks in the IoT network. The proposed mechanism, called learning-driven detection mitigation (LEDEM), has a hierarchical control plane and divides IoT devices into two categories: fixed (floT) and moving (mIoT). A local controller is responsible for a small part of network, and a universal controller manages all the local controllers. LEDEM detects DDoS attacks based on the feature of incoming packets; a machine learning model is trained with both labelled and unlabelled data to make the decision if an IoT device is compromised. [PERSON] et al. [30] also propose to use machine learning to detect DDoS attacks, they combine both cloud networks and wireless SDN to protect IoT networks against DDoS attacks. Once a new flow enters the network, the so-called OpCloudSec scheme uses deep brief network to analyse if it is an attack flow. Normal flows will be forwarded and known attack flows will be reported to the controller for further instructions. Even if it is a new kind of attack, OpCloudSec allows administrative update in the attack pattern database so that it becomes a known attack next time. [PERSON] et al. [31] propose a smart home-based model, called IoT-IDM, which employs machine learning in the intrusion detection in IoT networks. As smart home IoT devices need to be turned on/off manually, IoT-IDM selects the number of bytes in the command and response packets, along with inter-packet interval to be the detection met rics. By using both linear and nonlinear logistic regression model of machine learning, the precision rate could be over 94% from real implementation.