## 2 Related Work  
Several significant studies on SDN security proposed approaches [29; 30] to detect and mitigate DDoS attacks on SDN. Unfortunately, most existing approaches have limitations in detecting low- and high-rate DDoS attacks when both occur simultaneously. In addition, approaches for detecting DDoS attacks with different attack traffic rates have low detection rates and high false positive rates when attackers simultaneously attack multiple targets. Similarly, many existing approaches for detecting DDoS attacks on the SDN have limitations in detecting DDoS attacks with different attack traffic rates since they rely on a static threshold. As a result, the controller is still vulnerable to DDoS attacks, which might bring the entire network down or deny legitimate users access to network services [31]. Therefore, a dynamic threshold is proposed in this work to detect DDoS attacks on SDN controllers that use varying traffic rates (low- and high-traffic attack rates), originate from single or multiple hosts, and target one or more victims. Consequently, the proposed method is expected to have a high detection rate and a low false positive rate for DDoS attack detection. [PERSON] et al. [32] proposed a fusion entropy method for computing network traffic randomness to detect DDoS attacks in the SDN network environment. A dataset was used to evaluate and test the proposed approach. Furthermore, the proposed approach effectively detects the attack by showing an entropy value 91.25% lower than the entropy value of normal traffic flow. However, the proposed approach uses a fixed threshold, which reduces detection rates and increases false positive rates. In addition, the information about the dataset and the features used to detect DDoS attacks is lacking. Finally, it is only limited to high-rate DDoS attacks. [PERSON] et al. [33] proposed a new technique for detecting DDoS attacks on SDN controllers that operates in the network's data layer. The technique combines the k-means machine-learning method to leverage the rate features and asymmetry features of the traffic flow to be used in the detection trigger mechanism for detecting DDoS attacks. The collaboration between the control plane and the data plane resulted in highly accurate attack detection. However, the effectiveness of their proposed technique decreases when high-rate network traffic is involved. [PERSON] et al. [34] introduced a unique approach known as Jensen-Renyi divergence (JRD) based on information theory. The proposed method identifies DDoS attacks at a high rate in SDN-based network flows. Because there are fewer traffic characteristics to calculate, this approach has a reduced computing requirement. The detecting method begins with time intervals and then extracts the appropriate traffic characteristics (i.e., source and destination IP, source and destination port, and protocol operated). Finally, the technique calculates information theory metrics for detection using source IP addresses. The proposed technique, on the other hand, achieves lower performance, especially for low-rate DDoS attacks. [PERSON] et al. [35] proposed a machine-based factorization detection technique for detecting low DDoS attack traffic rates. The proposed method was integrated with a support vector machine (SVM) and extracted features to categorize low-rate DDoS attack traffic using the dynamic deletion of flow rules. [PERSON] et al. [36] proposed a new approach termed a safeguard scheme that mitigates DDoS attacks on the SDN controller (SGS). It uses behavior features for DDoS attack detection. The proposed method has two models. The first model detects any suspicious traffic in the data plane, and the second model is the controller's dynamic defense in the control plane. The technique, however, is incapable of detecting low-rate DDoS attacks, and it relies on multiple controllers, which take longer to detect DDoS attacks. Furthermore, [PERSON] et al.