  Recent years witnessed a surge in network traffic due to the emergence of new
online services, causing periodic saturation and complexity problems.
Additionally, the growing number of IoT devices further compounds the problem.
Software Defined Network (SDN) is a new architecture which offers innovative
advantages that help to reduce saturation problems. Despite its benefits, SDNs
not only can be affected by traditional attacks but also introduce new security
challenges. In this context, Distributed Denial of Service (DDoS) is one of the
most important attacks that can damage an SDN network's normal operation.
Furthermore, if these attacks are executed using botnets, they can use
thousands of compromised devices to disrupt critical online services. This
paper proposes a framework for detecting DDoS attacks generated by a group of
botnets in an SDN network. The framework is implemented using open-source tools
such as Mininet and OpenDaylight and tested in a centralized network topology
using BYOB and SNORT. The results demonstrate real-time attack identification
by implementing an intrusion detection mechanism in the victim client. Our
proposed solution offers quick and effective detection of DDoS attacks in SDN
networks. The framework can successfully differentiate the type of attack with
high accuracy in a short time
