In the realm of network technology, Software—Defined Networking (SDN) has transformed modern network design and management with its enhanced flexibility and centralized control. However, it also confronts security vulnerabilities, a major challenge in the face of increasingly complex cyber threats. This paper presents an innovative solution to address SDN security issues. We combine Transformer-based autoencoder and Isolation Forest algorithms. The Transformer-based autoencoder, with its unique self—attention mechanism, excels at capturing complex traffic data relationships, enabling the identification of potential intrusion—related deviations by encoding and reconstructing traffic data. Then, the Isolation Forest algorithm, a proven outlier—detection method, helps precisely distinguish between harmless irregularities and real threats. Our experimental results demonstrate that this hybrid model outperforms traditional intrusion—detection systems in detection accuracy, false—positive rates, and adaptability to complex traffic scenarios. This work offers network administrators advanced tools to counter cyber threats, representing a significant step forward in securing SDN architectures and unlocking the full potential of SDN without the hindrance of security risks.