## 2 Background and the Related Work
### SDN with Multi-Controllers  
[PERSON] et al. [22] explain that SDN offers flexibility in network configuration by separating the control plane from the data plane. Despite this potential, one of SDN's drawbacks is that the controller reduces the overall availability of the network since it is a single point of failure. Multi-controller designs have been proposed as a way to offset the limitations of having a single controller in a network. Multiple controllers increase network reliability because they allow the data plane to keep running even in the event that one controller fails. For large networks, multi-controller implementation can solve the scalability and reliability issues introduced by the SDN centralized logical control concept. Unlike single-controller SDN, multi-controller SDN introduces new challenges that directly impact security and network performance. Attackers employ correlated and distributed attacks, where they target only a subset of controllers before launching a coordinated attack on the entire network, which does not apply to single controller setups. Additionally, in a multi-controller system, each controller only has partial knowledge of the overall network state. This means security mechanisms must operate in a distributed manner, which may lead to inconsistencies or blind spots in attack detection and mitigation. Inter-controller communication further complicates real-time mitigation due to latency and overhead despite multi-controllers offering load distribution. Moreover, there are many constraints on the scalability and performance of a single SDN controller. As a result, multi-controllers are needed for large-scale networks. Additionally, there are many performance and scalability restrictions on a single SDN controller. However, multiple controllers significantly increase network complexity and provide a number of new difficulties for SDN scheduling and management. Since the placement of the controllers has a significant impact on availability, performance, and latency, the distributed control architecture presents concerns that impact the network as a whole. To achieve high network reliability, better load balancing across controllers, and low latency between controllers and switches, researchers define multi-objective optimization controller placement (MOCP) [23]. Current studies focusing on multi-controller based attack detection are limited in scope and network optimization. [PERSON] et al. [24] and [PERSON] et al. [25] propose solutions for detecting DDoS attacks in multi-controller environments. [PERSON] et al. [24] propose a fault-tolerant framework for detecting DDoS attacks in SDN. They develop a multi-controller based approach using combined entropy and packet window initiation rate to detect attacks mainly in multi-victim scenarios. Their method achieves a 95% detection rate and improves network availability by implementing a leader election algorithm for controller failover. [PERSON] et al. [25] proposes a hybrid model for detecting and classifying DDoS attacks in multi-controller SDN environments. Using entropy-based detection combined with deep learning, they employ chi-square feature selection and LSTM networks to identify attacks efficiently. Their proposed model achieved higher accuracy (99.421%) on the CICIDoS2019 dataset, surpassing other existing models like CNN, RNN-AE, and MLP-AE. However, their physically distributed but logically centralized architecture acts as a single controller and does not consider inter-domain and intra-domain attacks. [PERSON] et al. [26] propose an early detection and mitigation method for DDoS attacks in SDN using entropy variation of destination IP addresses. Their proposed approach can detect attacks within the first 250 packets of malicious traffic by analyzing the randomness of incoming packet destinations, utilizing a multi-controller SDN structure. They mitigate the attack by adjusting flow idle timers to quickly remove malicious flows while preserving legitimate traffic.