## 4 Characterising SDN-Based IoT Architecture
### The Proposed Algorithm for Mitigating DDoS  
The proposed SECOD algorithm is running in the application layer of SDN architecture, it makes the rule to manage the network, as well as protects the network against DDoS attacks. Predefined policies in the SECOD are converted to flow entries via the controller, and then these policies are inserted to the OpenFlow switches to allow or block the access in the data plane. Note that SECOD and controller are running within the same device in our test, which means an internal link between the control and application layer is built within the same device. The main workflow of SECOD is given in Figure 2. SECOD monitors the network and compares the real-time counter with threshold every fixed time period, and an excess of Packet_In messages could lead to DDoS detection or threshold update. Threshold update is used to handle burst traffic, while malicious traffic triggers detection function. In the DDoS detection, SECOD figures out where is the attack coming from--host or switch--so as to execute relevant mitigation process. The mitigation function keeps running until the attack is over, and then the threshold is reset. Finally, SECOD goes back to the monitor phase under normal state. For high-demand benign traffic, threshold will adjust dynamically to adapt to the environment. However, if the demand is too high to handle, the traffic will be labelled as malicious. Because it has reached the limit of device, either switch or controller, the traffic will be dropped automatically even without any algorithm to do so. Some key parameters in SECOD are defined in Table 4, and more details in [8; 9]. There are five main modules:  
1. **Monitor Function:** SECOD counts the number of _Packet_In_ messages \(\gamma_{ij}\) generated from \(i\)th port in \(j\)th switch, as well as per IP address \(\gamma_{ijk}\). Then, it sums up the total number of _Packet_In_ messages per switch \(\Sigma_{j}\gamma_{ij}\), and compares with \(\omega\). Once \(\Sigma_{j}\gamma_{ij}\) exceeds \(\omega\), it means the controller is overloaded and the algorithm enters _DDoS Detection_ module. Apart from \(\omega\), if one or multiple \(\gamma_{ij}\) are greater than \(\alpha_{ij}\) and \(\Sigma_{j}\gamma_{ij}\) is still under \(\omega\), then the algorithm enters _Threshold Update_ and only updates the \(\alpha_{ij}\). Thus, each port of switch has a different threshold due to its past workload after the network running for some time. 2. **Threshold Update Function:** This function is mainly used to update \(\alpha_{ij}\). During network initialisation, \(\alpha^{{}^{\prime}}_{ij}\) is used as a reference for DDoS detection, and later this threshold is updated to \(\alpha_{ij}\) which reflects the network operation. \(\alpha_{ij}\) keeps updating according to history statistics when the network is in normal state. If the network is just recovered from DDoS attack, \(\alpha_{ij}\) is reset to \(\alpha^{{}^{\prime}}_{ij}\), as the statistics during DDoS attacks cannot reveal the normal behaviour of network. 3. **DDoS Detection:** This is the attack localisation phase before entering mitigation phase. The controller first sends a flow entry to all the suspicious switches, and this flow entry asks the switch to drop all the new flows that cannot match the existing flow table within a extremely short period. If the controller receives no _Packet_In_ messages during that period, then the attack is originated from hosts; otherwise, the switch is compromised. Depending on the result, it goes to _Host/Switch Mitigation_. 4. **Host Mitigation:** SECOD checks \(\gamma_{ijk}\) and compares with \(\rho\). If there is only one abnormal \(\gamma_{ijk}\), the controller inserts a flow entry to switch j so as to block packets from the suspicious IP address. If there are multiple anomalous \(\gamma_{ijk}\), the controller asks the switch to drop all the packets from that port. The flow entry to block packets has idle timeout enabled, so that it is removed as soon as the attack stops. 5.