## 1 Introduction  
Traditional IP networks are too complex and difficult to manage due to the vertical bonding between the control plane and the data plane. Network resources are underutilized given the complexity and unpredictability of traditional IP networks [1]. A new concept of software-defined networking (SDN) technology has been introduced to address this problem. SDN technology decouples the control plane from the data plane, allowing the programmability of IP networks [2; 3; 4; 5]. The SDN architecture has been adopted by many businesses and government sectors [6; 7] for its appealing features, including network programmability, unified control, capabilities, and a global view of the network topology in the controller. However, similarly to traditional IP networks, SDN confronts various research challenges such as network failures, security, and privacy threats. As SDN is expected to be one of the dominant networking technologies in the near future, developing novel security mechanisms to tackle these security threats has become a necessity. One of the most common security threats is the distributed denial-of-service (DDoS) attack that has plagued the Internet for more than 20 years, and it is becoming even more aggressive with the development of the Internet of Things (IoT) [8; 9; 10]. DDoS attacks have evolved, progressing from basic to high-rate to sensible low-rate traffic [11]. A new security threat known as low-rate DDoS (LDDoS) has emerged as a result of this timely transformation of DDoS attacks [12]. LDDoS attacks can take a variety of forms, such as denying service to servers by sending a very low-rate request to disrupt application services. Attackers may also use tools such as SlowDroid [13] to launch low-rate attacks on smartphones with limited processing power and exploit weaknesses in the application layer using protocols such as Slow Next [14]. LDDoS attacks pose a serious security threat to both traditional IP networks and SDN [15; 16]. Detecting LDDoS attacks is more difficult because the generated traffic is disguised as legitimate traffic. The attack is launched from a separate source and the typical rate is low enough that the number of packets delivered is insignificant, making detection difficult. LDDoS attacks are undetectable using standard DDoS detection security measures and implementations [17]. It is envisaged that more efforts are needed to increase the SDN level of protection against LDDoS. A survey on existing detection mechanisms will be useful for researchers to be aware of current the state-of-the-art methods and propose more efficient detection mechanisms. Many relevant surveys on security detection mechanisms for SDN can be found in the literature, but they are limited only to high-rate DDoS attacks and not LDDoS attacks. In this paper, we survey various research studies developed for LDDoS detection mechanisms for SDN using machine learning (ML) methods. The study is motivated by the fact that LDDoS is a novel and difficult-to-detect type of DDoS attacks, and ML methods are appealing and effective in detecting DDoS attacks. This paper provides a comprehensive overview of security solutions proposed for all layers of SDN against LDDoS using ML models. The various threats and effects of LDDoS attacks on SDN architecture layers are highlighted; a summary and comparison of LDDoS detection mechanisms for SDN based on ML and deep learning (DL) methods are provided, and open research problems and future directions for SDN security researchers working on LDDoS detection are discussed. Therefore, the contribution of this paper summarized in three points:  
* To identify various types of threats and effects of LDDoS attacks on different layers of SDN architecture;
* To provide a summary and comparison of LDDoS detection mechanisms for SDN based on machine learning and deep learning approaches;
* To discuss the open research problems and future directions for researchers working in the domain of SDN security based on LDDoS attack detection.