## 1 Introduction  
Software-defined networking (SDN) is a revolutionary network technology that will eventually replace traditional networks. SDN revolutionizes network management by offering creative solutions to traditional network challenges. As a result, various features distinguish SDN from traditional networks, such as a separation of the control plane and the data plane. The separation enables the SDN to provide data center operators with centralized network management through a controller [1, 2, 3], resulting in reduced operational costs by boosting the efficiency of network traffic management [4, 5]. For example, the SDN allows the operators to comprehensively control network properties to meet the ever-changing network business requirements. The controller's importance to the SDN network makes it an appealing target for attackers looking to disrupt the network. Denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks are two types of attacks that can cause network disruption [6]. There are many threats to the controller, but a DDoS attack is one of the most significant threats because it could shut down the entire network and prevent legitimate users from accessing network services [7, 8]. DDoS attacks against the SDN controller can be launched using a variety of methods [9], such as flooding the network or the controller with vast amounts of packets or traffic to the point where the controller's resources are exhausted and unable to handle subsequent incoming packets. Another way to flood the network hosts with massive traffic is by using spoofed source IP addresses, forcing the switches to send all incoming packets to the controller for processing. Eventually, the controller's resources will be exhausted, affecting its ability to process incoming packets that result in network deterioration, network collapse, and the denial of legitimate users' access to network services or resources [10]. A threshold mechanism is one of the techniques used for detecting DDoS attacks by enabling the identification of network traffic flow, whether normal or attack traffic [11; 12]. However, it is not easy to effectively establish the threshold value since it is dependent on the network traffic flow characteristics. However, some researchers rely on observation and experimentation to determine the threshold value. The fundamental disadvantage of predefined threshold-based detection systems is that a fixed threshold may be useless if the attack traffic rate changes, resulting in a low DDoS attack detection rate and a high false positive rate [13]. Consequently, undetected DDoS attacks often exceed the threshold value, resulting in the controller being subjected to attack traffic. [PERSON] et al. [14] proposed a fixed threshold value based on their detection approach experiment to detect DDoS attacks on the SDN controller involving a single victim. Nonetheless, several current techniques that rely on a dynamic threshold in non-SDN networks to detect DDoS attacks, such as [15; 16], contribute to our understanding of the dynamic threshold fundamentals to be implemented in the SDN environment. Furthermore, using the adaptive threshold improves the detection rate and decreases false positive rates. The adoption rate of the SDN architecture is increasing due to the need to manage vast amounts of data and this requires the use of a controller that can be updated with new rules or instructions to manage new incoming traffic flows and be flexible enough to deal with various types of network traffic using a programmable controller [17; 18]. Meanwhile, disruptive attempts on the SDN controller are becoming increasingly frequent with DDoS attacks. The most significant network threats are DDoS attacks with varying traffic rates (low or high). Many researchers have conducted studies on the security of SDN [19; 20; 21], including techniques related to detecting and mitigating DDoS attacks on SDN [22; 23].