The extensive use of Internet of Things (IoT) technology has recently enabled the development of smart cities. Smart cities operate in real-time to improve metropolitan areas’ comfort and efficiency. Sensors in these IoT devices are immediately linked to enormous servers, creating smart city traffic flow. This flow is rapidly increasing and is creating new cybersecurity concerns. Malicious attackers increasingly target essential infrastructure such as electricity transmission and other vital infrastructures. Software-Defined Networking (SDN) is a resilient connectivity technology utilized to address security concerns more efficiently. The controller, which oversees the flows of each appropriate forwarding unit in the SDN architecture, is the most critical component. The controller’s flow statistics are thought to provide relevant information for building an Intrusion Detection System (IDS). As a result, we propose a five-level classification approach based on SDN’s flow statistics to develop a Smart Attacks Learning Machine Advisor (SALMA) system for detecting intrusions and for protecting smart cities from smart threats. We use the Extreme Learning Machine (ELM) technique at all levels. The proposed system was implemented on the NSL-KDD and KDDCUP99 benchmark datasets, and achieved 95% and 99.2%, respectively. As a result, our approach provides an effective method for detecting intrusions in SDNs.