I have included some literature sources on the subject of "Anomaly Detection in SDN". I hope these literature sources can help you.
Best regards and good luck
Anatol Badach
Daojing He, Sammy Chan, Xiejun Ni, Mohsen Guizani: Software-Defined-Networking-Enabled Traffic Anomaly Detection and Mitigation; IEEE Internet of Things Journal, Vol. 4, Issue 6, Dec 2017
Junfeng Xie, F. Richard Yu, Tao Huang; Renchao Xie, Jiang Liu, Chenmeng Wang, Yunjie Liu: "A survey of machine learning techniques applied to software defined networking (SDN): Research issues and challenges", IEEE Communications Surveys & Tutorials, Vol. 21, Issue 1, Firstquarter 2019, DOI: 10.1109/COMST.2018.2866942
https://ieeexplore.ieee.org/document/8444669
Li-Der Chou, Chien-Chang Liu , Meng-Sheng Lai , Kai-Cheng Chiu, et al.: „Behavior Anomaly Detection in SDN Control Plane: A Case Study of Topology Discovery Attacks“; Hindawi Wireless Communications and Mobile Computing, Vol 2020, Article ID 8898949, Nov 2020; DOI: 10.1155/2020/8898949
Trung V. Phan, Tri Gia Nguyen, Nhu-Ngoc Dao, Truong Thu Huong, Nguyen Huu Thanh, Thomas Bauschert: „DeepGuard: Efficient Anomaly Detection in SDN With Fine-Grained Traffic Flow Monitoring“; IEEE Transactions on Network and Service Management, Vol. 17, Issue 3, Sep 2020; DOI: 10.1109/TNSM.2020.3004415