The rapid expansion of Software-Defined Internet of Things (SD-IoT) networks has amplified both scalability and vulnerability, exposing them to increasingly sophisticated multi-vector attacks such as flooding-based Distributed Denial-of-Service (DDoS), Address Resolution Protocol (ARP) spoofing, DNS spoofing, and MAC flooding. These threats exploit static control planes and centralized architectures, overwhelming controllers and bypassing threshold-based defenses through adaptive, sequential, and hybrid behaviors. To address these challenges, we propose SFARP, a multi-layered real-time security framework tailored for SD-IoT environments. SFARP integrates three coordinated modules: (1) the Dynamic Flow Analysis Module (DFAM), which leverages P4-programmed switches to extract fine-grained traffic and ARP-level features; (2) the Adaptive Dynamic Flow Detection System (ADFDS), which employs an …