## 4 Methodology
### Feature Extraction and Data Preprocessing
The algorithm requires four inputs as follows: (1) \(OF\) represents the captured OpenFlow traffic; (2) \(T\) is the time window of the extracted dataset; (3) \(S\) is the dataset time shifting; and (4) \(L\) is the type of the OpenFlow traffic which could be normal or attack traffic. The output is a dataset \(X_{j}=\{x_{1},x_{2},x_{3},...,x_{n}\}\), which is a sequence of labeled samples, and each sample \(x_{j}\) contains the following features: number of Packet-In messages, number of Flow-Mod messages, number of Packet-Out messages, number of TCP_ACK messages, and the label which equals to \"0\" when the sample is extracted from normal traffic and \"1\" when the sample is extracted from attack traffic. The algorithm extracts the selected features from the packet sequence of OpenFlow traffic \(OF\) within the defined time window \(T\) (lines 9-16). Then, for each OpenFlow packet in \(OF\), we extract the type of the OpenFlow message. The message type is compared with **our features**, and if match occurs, then the corresponding counter is incremented by one. Afterward, the packet time and the starting time are compared; if the difference between them is larger than time window \(T\), the dataset generation tool creates a new sample \(x_{j}\) with the corresponding label, and **the dataset index \(J\) is incremented** by one (lines 6-8). Line 17 shows how after creating a new sample \(x_{j}\), the algorithm updates the value of \(firstPacketIndex\), where the shifting parameter \(S\) is added to the starting index of the next shift. In other words, we divide the captured OpenFlow traffic into many parts, where the length of each part equals \(T\). Then, we count the number of Packet-In, Packet-Out, Flow-Mod, and TCP-ACK messages of each part. The generated dataset has many samples, \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Attacks Type** & **Number of Packet-In** &
\begin{tabular}{c} **Number of** \\ **Packet-Out** \\ \end{tabular} & **Number of Flow-Mod** & **Number of TCP-ACK** \\ \hline UDP & \(\dagger\) followed-by & \(\Downarrow\) & \(\Downarrow\) & \(\dagger\) \\ \hline TCP SYN & \(\dagger\) & \(\dagger\) followed-by & \(\dagger\) followed-by & \(\dagger\) \\ \hline ICMP & \(\dagger\) & \(\dagger\) followed-by & \(\dagger\) followed-by & \(\dagger\) followed-by & \(\dagger\) followed-by \\ \hline TCP SARFU & \(\dagger\) followed-by & \(\dagger\) followed-by & \(\dagger\) followed-by & \(\dagger\) followed-by & \(\dagger\) followed-by \\ \hline IP Spoofing & \(\dagger\) followed-by & \(\dagger\) followed-by & \(\dagger\) followed-by & \(\dagger\) followed-by \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The impact of saturation attacks on the main OpenFlow messages. Figure 3: The UDP attack impact on the Packet-Out and Packet-In messages. where each sample represents each part of length \(T\). We use the shifting parameter to simulate different starting points of DDoS attacks and increase the amount of overlap in the extracted dataset. ```
Input: OpenFlow traffic \(OF\), Time-Window \(T\), Time-Shifting \(S\), Traffic-Type \(L\) {0,1}. Output: Dataset \(X_{J}\). Declare:\(packet1n\), \(packetOut\), \(packetMod\), \(tcpAck\), \(Msg_{(type)}\)
1\(J=0\) (the index of the output sample \(X_{J}\)) repeat
2\(firstPacketIndex=1\) // (\(Pi\) is the \(1^{st}\) packet of the current shift) \(startTime=P_{time}(firstPacketIndex)\) /* (is the \(1^{st}\) packet time of the current shift) */
3 for(\(i=firstPacketIndex\); \(i<n\); \(i++\)) do
4 if\(P_{time}-startTime>T\)then
5\(createNewSample_{xj}\) (\(packetInt,packetOut,packetMod,tcpAck,L\), increment )
6 add a new sample \(x_{j}\) to \(X_{j}\) with traffic type \(L\) and increase \(J\) by one.