Software-defined networking (SDN) is becoming a predominant architecture for managing diverse networks. However, recent research has exhibited the susceptibility of SDN architectures to cyberattacks, which increases its security challenges. Many researchers have used machine learning (ML) and deep learning (DL) classifiers to mitigate cyberattacks in SDN architectures. Since SDN datasets could suffer from class imbalance issues, the classification accuracy of predictive classifiers is undermined. Therefore, this research conducts a comparative analysis of the impact of utilizing oversampling and principal component analysis (PCA) techniques on ML and DL classifiers using publicly available SDN datasets. This approach combines mitigating the class imbalance issue and maintaining the effectiveness of the performance when reducing data dimensionality. Initially, the oversampling techniques are used to balance the classes of the SDN datasets. Then, the classification performance of ML and DL classifiers is evaluated and compared to observe the effectiveness of each oversampling technique on each classifier. PCA is applied to the balanced dataset, and the classifier’s performance is evaluated and compared. The results demonstrated that Random Oversampling outperformed the other balancing techniques. Furthermore, the XGBoost and Transformer classifiers were the most sensitive models when using oversampling and PCA algorithms. In addition, macro and weighted averages of evaluation metrics were calculated to show the impact of imbalanced class datasets on each classifier.

Software-Defined Networking (SDN) enables centralized control and programmability, providing a promising foundation for intelligent traffic management and enhanced security. This paper proposes a simulation-based SDN framework that integrates multiple Machine Learning (ML) models to evaluate the effectiveness of cyberattack detection and to manage packet resilience through the analysis of metrics such as throughput, switch delay, controller response time, and security performance indicators. Experimental results demonstrate that the Decision Tree (DT) and Extreme Gradient Boosting (XGBoost) classifiers achieved higher throughput, whereas the Deep Neural Network (DNN) and Transformer models imposed greater computational overhead. In addition, the DT and Random Forest (RF) models showed an accuracy–responsiveness trade-off, with better throughput and less processing time. Experimental results demonstrate high classification accuracy, with DT, RF, and XGBoost achieving near-perfect detection rates, whereas DNN and Transformer models maintained competitive performance despite certain class-specific limitations. The F1-scores validate the robustness of these classifiers. Complementary SDN simulations assessed packet management efficiency, yielding a consistent packet drop rate of approximately 31–32%, throughput ranging from 7.55 to 9.79 packets/s, and average switch delays around 12 ms across models. The findings confirm that the suggested hybrid approach not only detects cyberattacks effectively but also maintains acceptable SDN performance under diverse traffic conditions.