Software Defined Networks (SDN) can logically route traffic and utilize underutilized network resources, which has enabled the deployment of SDN-enabled Internet of Things (IoT) architecture in many industrial systems. SDN also removes bottlenecks and helps process IoT data efficiently without overloading the network. An SDN-based IoT in an evolving environment is vulnerable to various types of distributed denial of service (DDoS) attacks. Many research papers focus on highrate DDoS attacks, while few address low-rate DDoS attacks in SDN-based IoT networks. There's a need to enhance the accuracy of LDDoS attack detection in SDN-based IoT networks and OpenFlow communication channel. In this paper, we propose LDDoS attack detection approach based on deep learning (DL) model that consists of an activation function of the Long-Short Term Memory (LSTM) to detect different types of LDDoS attacks in IoT networks by analyzing the characteristic values of different types of LDDoS attacks and natural traffic, improve the accuracy of LDDoS attack detection, and reduce the malicious traffic flow. The experiment result shows that the model achieved an accuracy of 98.88%. In addition, the model has been tested and validated using benchmark Edge IIoTset dataset which consist of cyber security attacks.

Software Defined Networks (SDN) provide rapid configuration, scalability, and management through a dynamic, programmable architecture that surpasses traditional network limitations. However, detecting Distributed Denial of Service (DDoS) attacks remains challenging, threatening both traditional and SDN-based networks. Machine Learning (ML) and Deep Learning (DL) technologies in conjunction with SDN have shown significant potential in effectively countering these threats. Prior studies primarily addressed high-rate DDoS attacks, neglecting low-rate DDoS attacks that resemble legitimate traffic, and often using outdated datasets. While researchers employ various offline learning algorithms to identify DDoS attacks, online learning classifiers remain underexplored. Our goal is to offer an intrusion detection model tailored to SDN networks, using the online passive-aggressive classifier. The proposed model achieves a 99.7% average detection rate for normal vs. DDoS network traffic, outperforming similar models on multiple datasets, including (CICDDoS2019, and InSDN. slow-read-DDoS), effectively detecting and mitigating DDoS attacks.