###### Abstract
On the other hand, having a short time window renders the captured traffic amount insufficient for providing reliable and accurate detection results. However, works in the literature, such as [7; 14; 15], use an arbitrary pre-defined and fixed time window for collecting and analyzing the SDN network traffic. This has a significant impact on the performance of the ML-detection methods as mentioned earlier. The detection of unknown saturation attacks is a key concern in SDN, which, if not detected in early stages, can render the SDN environment vulnerable to flooding attacks. Many research works show different attack techniques [9; 10; 11]. However, they use a single machine-learning classifier to detect limited types and pre-defined (known) saturation attacks (e.g., SYN flooding attack). It is unclear whether they can detect different types of (unknown) saturation attacks. In this paper, we address the aforementioned issues by providing answers to the following questions:  
1. Is it possible to find the proper time window for performing OpenFlow traffic analysis, and if so, what is it? 2. How is the detection performance of ML classifiers affected by the variation of the time window? 3. How effective are the existing ML classifiers for detecting unknown saturation attacks? To address questions 1 and 2 and discover the proper time window for detecting DoS saturation attacks, we investigate the detection robustness of the widely used supervised classifiers such as K-nearest neighbor (K-NN), support vector machine (SVM), and naive Bayes (NB) using different time window configurations of OpenFlow traffic analysis. In addition, we evaluate the impact of various time windows of traffic analysis on the performance of detecting these attacks by conducting the false-negative analysis. To address question 3, we evaluate supervised (SVM, K-NN, and NB) and semi-supervised (Isolation Forest, Basic Autoencoder, One-Class SVM, and Variational Autoencoder) classifiers for detecting unknown saturation attacks. The supervised classifiers are evaluated using two-evaluation scenarios: the best-case training method and the worst-case training method. The experimental results of the best-case scenario training method show that the SVM, NB, and K-NN classifiers can detect unknown saturation attacks. However, the experimental results of the worst-case scenario training method show that the supervised classifiers fail to detect unknown attacks. Thus, we adopt the semi-supervised classification algorithms. The results show that semi-supervised classifiers can detect unknown attacks. Specifically, the variational autoencoder provides a higher detection performance. To further improve the detection of unknown and known flooding attacks, we proposed the hybrid approach. This approach focuses on taking advantage of two classification algorithms: a supervised algorithm to effectively detect known attacks and semi-supervised algorithm to detect unknown flooding attacks. The results show that the hybrid approach provides higher detection performance for both known and unknown attacks than a single supervised and semi-supervised classifier. To summarize, the contributions of this paper are as follows:  
* To our knowledge, this work is one of the very first of its kind to study the effectiveness of using the supervised and semi-supervised classifiers in detecting the unknown DoS saturation attacks in SDN. * We propose a hybrid approach that combines the semi-supervised and supervised classifiers to detect the unknown and known DoS flooding attacks. * Two datasets of different types of saturation attacks are created using the simulated and physical SDN environments which will help in promoting further research in SDN security (we will disclose these datasets and the code after the acceptance of this paper). The remainder of this paper is organized as follows. Section 2 reviews the related work. Section 3 describes a brief introduction about saturation attacks in SDN.