Abdinasir HirsiJafar Ismail MohamedAbubakar Abdi WarsameAbdirizak Abdullahi KhalifLukman Audah0000-0001-8880-6153Adeb SalhSalman AhmedDiani Galih SaputriAbdiaziz Mohamed Abdirahman2026-10-142026-10-142025-05-27979833150894410.1109/ICIT64950.2025.11049252https://dspace-cris.utar.edu.my/handle/123456789/11732Software-Defined Networking (SDN) offers significant advantages in network management and scalability, but is vulnerable to security threats, particularly distributed denial-of-service (DDoS) attacks. These attacks can manipulate SDN flow tables and disrupt the network operations. This paper presents a comprehensive survey of supervised, unsupervised, and ensemble machine-learning techniques for DDoS detection in SDN. To the best of our knowledge, no previous study has provided such a detailed analysis within a single work. This study evaluates the effectiveness of various machine-learning models, focusing on their applications, benefits, and limitations in securing SDN environments. It reviews state-of-the-art methods and discusses performance metrics such as accuracy and computational complexity. The paper also identifies key research challenges and future directions for DDoS detection in SDN. The structure includes a review of related studies, a taxonomy of machine learning techniques, and a conclusion summarizing the findings and implications. © 2025 IEEE.en-USCybersecurityDDoS AttacksDeep LearningSDN SecuritySDN VulnerabilitiesDenial-of-service attackLearning algorithmsLearning systemsNetwork securitySoftware defined networkingCyber securityDeep learningDenialof- service attacksDistributed denial of serviceDistributed denial-of-service attackNetworking securitySoftware-defined networking securitySoftware-defined networking vulnerabilitySoftware-defined networkingstext::conference output::conference proceedings::conference paper