# Mitigating Timing Side-Channel Attacks in Software-Defined Networks: Detection and Response +
## 4 Experiments and Results
Finally, Arping [57] was used to dispatch ARP requests to multiple IP addresses within the local network. In most cases, these requests prompted hosts to respond with ARP replies, thereby providing a straightforward method for generating local network traffic and facilitating tasks, such as MAC address resolution. Each of these utilities plays a crucial role in the creation of a comprehensive and accurate dataset tailored specifically to the SDN environment. For probe traffic, we utilised attack ping scanning, broadcast traffic, and map scan traffic. We ran these scripts for 12 h to obtain a comprehensive dataset. The features of concern in formulating a dataset are the source and destination MAC addresses, timestamps, time-to-live (TTL), and protocol. To train the machine learning model, we extracted flows with unknown destination MAC addresses. The Listener API selects 'packet-in' and sends samples to MongoDB. A total of 60,649 samples were collected from this dataset. We converted these samples to JSON to implement them in our machine learning model. This phase employed the 'Mongo-export function'. After data collection, a Python-based preprocessing application was used to clear, organise, and label the samples. This application transforms the unprocessed dataset into a usable format, which is an essential step in any machine learning method that prepares raw data for the subsequent machine learning model. This application, which is intended to accept JSON data as input from the preceding preprocessing phase, separates and labels the data samples. Based on the unique algorithm detailed in the following section, these samples were identified as malicious timing sensors. In the training phase, we implemented a detection algorithm (detailed in Section 3.3.3) and selected a classification technique for our machine learning model. To implement the detection Algorithm 1 and sample timing probes effectively, the following fields are extracted from the dataset:'source MAC address', 'destination MAC address','source IP address', 'destination IP address', 'time stamp', 'TTL', and 'protocol'. These features were used for the data classification. Source and destination MAC addresses are crucial for determining the number of samples with known and unknown destination MAC addresses. We select ten samples at a time and counted the number of samples whose destination MAC addresses were unknown. We used a Python-based training application to train the machine learning model. This pre-processing gives us 42,489 samples. The training module is also responsible for machine learning classification. We compared four tree-based machine learning classification techniques to determine the best classification method for training: random forest [4], decision trees [5], XGBoost [6], and bagging [7]. We implemented each algorithm using the proposed approach. This step is performed to determine the best classification algorithm for the detection stage. The results of this section are analysed and the results from this step are detailed in further sections. The outcome of this step validates that the random forest algorithm is the best-suited classification method for the training phase. The network topology was reset during the monitoring phase of the experiment. Following this, we initiated a monitoring application that was programmed to precisely identify the IP and MAC addresses of the malicious host. Additionally, the application identifies the switch and port to which the malicious host is connected. Throughout the twelve-hour experiment, timing probes were generated at multiple intervals with varying attack frequencies per deployment. We recorded the number of attack samples in each phase. Multiple experiments were conducted to ensure the validity of our solution and account for potential variations in background traffic. The results were derived from the data obtained by processing the data in MongoDB using the characteristics of the monitoring app.