# Mitigating Timing Side-Channel Attacks in Software-Defined Networks: Detection and Response +
## 4 Experiments and Results
To verify the performance of detection Algorithm 1, we must first verify that probing traffic generates samples with unknown destination MAC addresses. To achieve this, we gathered the network statistics during the monitoring process. Figure 6 shows the network statistics for flows with known destination MAC addresses, flows with unknown destination MAC addresses, and the total number of flow samples. These parameters were monitored for ten attack attempts during the experiment and are denoted on the x axis. These are the most significant elements of the labelling procedure. During the experimentation phase, it was discovered that the number of timing probes (attack traffic) has a direct relationship with the number of flows with unknown destination MAC addresses. This validated the proposed classification algorithm and methodology. False positives and negatives for each attack attempt are summarised in Figure 7[47]. The \(x\) axis represents the number of attacks in a sequence. Clearly, the overall procedure produced a small number of false negatives. False negatives manifest in successive attack attempts. This also suggests that the solution involves learning more about the network and adapting to varying background traffic. We refer to equations for evaluating our model's precision score, recall score, and F1 score as Equations (1)-(3), respectively. The precision value was calculated as 94%, the recall value as 85%, and the F1 score as 89%. The F1 score was closer to 90%, indicating that our model's learning technique for detecting timing side-channel attacks in SDNs was accurate. We compared the random forest classification technique with the tree-based methods. The same dataset and algorithm are used to label the data. The F1 score, precision, and recall were obtained from three evaluation metrics. Figure 8  
Figure 6: Analysis of Network Flows via Destination MAC Address Recognition. Figure 7: Summary of False Positives and False Negatives per Attack Attempt. forest achieved the highest evaluation score. It has an F1 score of 89%, whereas the XGBoost, decision tree (DT), and bagging classifiers (BC) have scores of 87%, 84%, and 82%, respectively. In terms of precision, random forest performed better than the others by 94%. The XGBoost, DT, and BC scored 90%, 87%, and 85%, respectively. With a score of 85% for recall, random forest was the most stable classification method for our solution, whereas for XGBoost, DT, and BC, the scores were 84%, 81%, and 80%, respectively. The results indicate that the proposed machine learning-based technique is adequate for detecting time side-channel attacks in SDNs. Additionally, as shown in the results in Figure 8, the random forest method is the optimal classification approach for this solution. The attack probes were launched at predetermined intervals during the experiments. This guaranteed that the background activity was unique each time an attack was initiated. Advanced machine learning techniques and listener applications certify that the solution is efficient and undetectable. Next, we conducted an experiment for the response solution in two phases: phases A and B. In Phase A, we evaluated a scenario in which the data analysis module determined that the source host had not been detected previously. As this was the first probe attempt by the adversary in this experiment, the source was marked as not having been detected previously. This is sent to the response module, which generates a temporary customised rule. The response module uses the identity and activity characteristics of the source to formulate customised rules. These include the source MAC and IP addresses, destination addresses, and protocols. This customised flow is temporary, as it is set with an 'idle_timeout' value, which is a feature of the OpenFlow protocol. This means that if there is no matching attempt by the adversary for a certain amount of time, it is removed. The response module is directly connected to the controller to implement these flows.