Thanks for this excellent question.
The answer is very similar to the one which we use for traditional network environment. We use IPS/IDS to keep an eye on various suspicious behaviors/patterns of traffic. We also need those here but in virtual format. SDN Controller should have access to these virtual security appliances in order to enforce policies and monitor suspicious/malicious traffic and block (or raise alerts) depending on the preference of network admin. In this way, we can avoid flooding which result in Denial of Service attack and we end up running out of resources.