## 2 Background and the Related Work  
### SDN Security Threats and Attacks  
SDN is becoming more challenging as a result of the significant rise in internet users and the resulting increase in network security risks. One of the most common and hazardous types of attacks in SDNs is DDoS [7; 8]. Depending on the target plane, DDoS attacks in SDN can also be divided into three categories: application-layer, control-layer, and data-layer threats [9]. A number of strategies are employed for the detection, prevention, and mitigation of DDoS attacks, particularly on controllers in the SDN [10].  
While SDN offers numerous benefits over cloud and network service providers (e.g., 5G/Telco/ISP), its widespread adoption is contingent upon addressing its security challenges. Targeted attacks have the ability to interfere with all three layers, primarily on the SDN software controller, making it the weakest link in the system overall, on the link between controllers (C2C), on the link between the controller and the switches (C2S), on the switches themselves, on applications, and on the link between the applications and the controller [5].  
DDoS attack has the ability to completely destroy the network in addition to preventing unauthorized users from accessing and using network resources [11]. Consequently, defending the SDN network against DDoS attacks is essential.  
There are different kinds of DDoS attacks, including ICMP flood, TCP flood, and UDP flood [12]. By running the attack source, an attacker drastically decreases the available bandwidth and stops the target host from communicating with the outside world by sending a lot of trash traffic to the target network.  
[PERSON] et al. [13] comprehensively reviewed about 70 well-known DDoS detection and mitigation techniques over SDN. Information theory-based approaches, machine learning-based methods, artificial neural networks (ANN)-based methods, and other miscellaneous methods are the four groups into which these techniques are classified. All the currently available DDoS detection solutions are divided into four groups based on the type of detection metric and detection technique used: information theory metrics, machine learning, artificial neural networks, and other defense solutions [9].  
ML has become a popular tool for helping with threat and security analysis, intrusion detection, and other related tasks. Deeper insights can be gained by correctly examining ML's support for a range of datasets produced by network traffic and a number of data characteristics [14].  
[PERSON] et al. [10] applied supervised ML methods, for example, Naive Bayes, support vector machine (SVM), and KNN for identifying DDoS attacks. The CIC-2019 dataset was used to train these algorithms. Ultimately, a real-time SDN simulation environment consisting of Mininet, Ryu controller, and SNORT NIDS was used to evaluate the performance of these approaches. As soon as an attack is detected and put to a blacklist for mitigation, the attacker's IP address and port number are blocked.  
SVM, hidden Markov model (HMM), decision tree (J48), Naive Bayes, the advanced support vector machine (ASVM), logistic regression, random trees, binary the bat algorithm, random forest, and KNN are some of the effective machine learning algorithms that many researchers have used for DDoS attack detection. Also, many researchers use effective algorithms, such as self-organizing maps (SOMs), exact-STORM, back-propagation neural network (BPNN), convolution neural network (CNN), recurrent neural network (RNN), and LSTM, to identify DDoS attacks in SDN [9; 15; 16; 17; 18; 19].  
[PERSON] et al. [20] used the NN classifier and the SVM classifier to identify the potentially hazardous connections. [PERSON] et al. [21] examined the detection of DDoS attacks using four ML techniques: random forest, K-nearest neighbors, Naive Bayes, and logistic regression.