###### Abstract  
Software-defined networking (SDN) is an innovative network paradigm, offering substantial control of network operation through a network's architecture. SDN is an ideal platform for implementing projects involving distributed applications, security solutions, and decentralized network administration in a multitenant data center environment due to its programmability. As its usage rapidly expands, network security threats are becoming more frequent, leading SDN security to be of significant concern. Machine-learning (ML) techniques for intrusion detection of DDoS attacks in SDN networks utilize standard datasets and fail to cover all classification aspects, resulting in under-coverage of attack diversity. This paper proposes a hybrid technique to recognize denial-of-service (DDoS) attacks that combine deep learning and feedforward neural networks as autoencoders. Two datasets were analyzed for the training and testing model, first statically and then iteratively. The auto-encoding model is constructed by stacking the input layer and hidden layer of self-encoding models' layer by layer, with each self-encoding model using a hidden layer. To evaluate our model, we use a three-part data split (train, test, and validate) rather than the common two-part split (train and test). The resulting proposed model achieved a higher accuracy for the static dataset, where for ISCX-IDS-2012 dataset, accuracy reached a high of 99.35% in training, 99.3% in validation and 99.99% in precision, recall, and F1-score. for the UNSW2018 dataset, the accuracy reached a high of 99.95% in training, 0.99.94% in validation, and 99.99% in precision, recall, and F1-score. In addition, the model achieved great results with a dynamic dataset (using an emulator), reaching a high of 97.68% in accuracy. autoencoder; denial-of-service (DDoS); deep neural network; DDoS detection; software-defined network (SDN) +
Footnote †: journal:  
flow table. This indicates that the next time a related packet comes to the switch, it can be acted upon without the need to refer to the controller [1; 2]. While the high degree of centralization of the controllers greatly simplifies network administration, it is a security nightmare. If these controllers are subject to a large amount of requests, they can be taken offline, rendering the network inoperable [3]. This makes SDN highly vulnerable to distributed denial-of-service attacks (DDoS), which overload the capacity of the controller and the flow tables in the switch, halting the processing of packets and leading the network to be ineffective. This weakness necessitates the need for backup controllers. DDoS attacks are one of the most common types of attacks. A DDoS attacker uses multiple compromised network devices to send numerous forged packets with random source IP addresses toward the target host in the same network, degrading service quality. By flooding the victim's device with these packets, the attacker attempts to deny legitimate users access to the services offered by the victim server. However, backup controllers face similar challenges, and can also be attacked and taken offline if network traffic is directed at them [4]. Due to this possibility, a system for the early detection and mitigation of these attacks is required. A powerful intrusion detection system (IDS) would preserve network performance, increase data security, prevent the loss of intellectual property, and limit potential liability for compromised notes or network data [5]. This need has resulted in extensive research on DDoS detection techniques. Neural networks have emerged as one of the most widely used IDS tools [6]. Many contributions to research on DDoS detection models include ways to identify and quantify common characteristics of the massive sets of illegitimate traffic that are used to flood a victim's network during DDoS attacks. Our objective is to design a model that detects DDoS attacks using a hybrid technique for detecting malicious network flows using an autoencoder and deep neural networks.