## 1 Introduction
### Motivation  
In recent years, there has been a growing interest within the scientific community to explore the realm of SDN security, aiming to overcome barriers hindering widespread SDN adoption. This research domain has a dual focus: one facet aims to harness SDN features to enhance security, while the other endeavors to establish a secure architecture for SDN systems. As outlined in [3], the paper offers an overview of security threats that pose risks to SDN and enumerates various attacks exploiting vulnerabilities and misconfigurations in the constituent elements of SDN. Additionally, the paper delves into a discussion highlighting the duality between utilizing SDN for security improvement and securing SDN itself. SDN security in IoT networks has emerged as well and it is presented in [4]. A distributed denial of service (DDoS) attack constitutes a malicious attempt to disrupt the regular flow of data to a specific server, service, or network by inundating the target or its surrounding infrastructure with an overwhelming surge of Internet traffic [5]. These attacks achieve their objectives by harnessing multiple compromised computer systems, encompassing both traditional computers and networked resources, such as Internet of Things (IoT) devices or SDN devices [6; 7], to generate attack traffic. In a broader context, visualizing a DDoS attack is akin to an unexpected traffic bottleneck on a network, obstructing the regular flow of traffic to its intended destination. The impact is analogous to an overwhelming surge of vehicles congesting a road, preventing smooth passage to the intended locations. DDoS attacks present a significant and escalating threat to the Internet [8]. Attackers continually adapt their tactics to evade security systems, prompting researchers to consistently refine their approaches to counter new attack strategies. As a result, the DDoS landscape has become increasingly advanced, making it challenging to attain a comprehensive understanding of the situation. On one hand, this complexity impedes a clear comprehension of the DDoS phenomenon, given the multitude of known attack types that create the impression of a vast and challenging problem. On the other hand, the diverse strategies employed by existing defense systems further complicate matters, making it challenging to identify their commonalities and differences and assess their effectiveness [5]. Previous works in the literature have explored the intersection of DDoS and SDN, as evident in [9; 10; 11; 12]. There exist very interesting pieces of research that highlight workflow scheduling in SDN-based IoT and Fog networks [13; 14] and mitigation strategies in IoT systems [15]. Leveraging SDN enables the routing of diverse network traffic through a unified physical network infrastructure while maintaining the desired level of isolation. To counter undesirable malicious traffic, an SDN-based IoT access control application is deployed on the SDN controller. This application meticulously examines each incoming/outgoing connection to IoT domains in accordance with predefined security policies. Approved connections trigger the SDN controller to issue relevant forwarding rules in the physical/virtual SDN switches along the specified networking path. Conversely, malicious traffic from cybercriminals is thwarted by implementing specific network access lists. Moreover, it has the capability to dynamically segregate malicious or suspicious network flows. SDN-based separation solutions, in this context, can provide varying levels of network abstractions. This allows for the effective separation of network traffic and the presentation of network views aligned with the desired security properties [16]. Additionally, the SDN controller possesses extensive visibility into the supervised data planes and, via the control plane, gathers network status information by dispatching statistics query messages to the switches.