## 5 Experiment Results and Discussions
### The Proper Time Window for Detecting Known Attacks  
For the physical environment, 30 datasets were extracted using the collected OpenFlow traffic. Each dataset corresponds to a different time window of OpenFlow traffic analysis. The time windows range from 1 min to 30 min. Each dataset was used to train and test K-NN, NB, and SVM classifiers. The recall, precision, and F-1 score were employed to evaluate the detection performance of our trained models and analyze the impact of different time windows on the prediction results of our models. Figure 3(a) demonstrates the precision, recall, and F1 score of the trained K-NN models using the datasets of different time windows that range from 1 min to 30 min. The K-NN classifier achieved the highest detection performance rate when the time window was equal to one minute of the OpenFlow traffic analysis: the recall was 95% with precision 96% and 95% F1 score. The lowest detection performance rate was obtained when the time window was equal to 30 min, where the corresponding recall is 98% with precision 47% and 64% F1 score. Thus, in the physical environment, the proper time window of the K-NN classifier is equal to one minute. To support this conclusion, Figure 3(a) demonstrates that the precision and F-1 score rates declined as the time window of the OpenFlow traffic increased. Figure 3(b) presents the detection performance results for the trained SVM models. The SVM classifier obtains the highest detection results when the time window equals one minute, in which the recall of 92%, precision is 91%, and the F1 score is 91%. When the time window equals 30 min, the SVM trained model obtains the lowest detection performance rate with a recall of 99%, precision 46%, and an F1 score of 62%. Figure 3(b) shows the impact of the time-window length on the SVM classifier detection performance. Particularly, the precision and F1 score values are decreased, and the recall value is increased as the time window is increased. Therefore, in the physical environment, the SVM classifier's proper time window to detect saturation attacks equals one minute. Similarly, we evaluated the NB classifier detection performance by conducting 30 experiments. For each experiment, different training and testing datasets of different time windows were used. As shown in Figure 3(c), the NB classifier obtains the highest detection performance when the time window is equal to three minutes with 80% recall, 99% precision, and an F1 score of 89%. The lowest detection results are obtained by the NB trained model when the time window equals 30 min with 53% recall, 52% precision, and an F1 score of 52%. By using the OpenFlow traffic simulation environment, 20 datasets were extracted. Each dataset represents a different time window of OpenFlow traffic analysis. The datasets' time window ranges from 1 min to 20 min. These datasets were used to evaluate the classifiers. In each experiment, we recorded the recall, precision, and F-1 score for the trained models to evaluate their detection performance. Figure 4: The detection performance of supervised classifiers using SDN physical environment. **(a)** K-NN performance on different time windows on physical environment; **(b)** SVM detection performance on different time windows on physical environment; **(c)** NB detection performance on different time windows on physical environment. As shown in Figure 5a, the K-NN classifier achieves the highest detection performance when the time window equals one minute with 99% recall, 97% precision, and 98% F-1 score. Furthermore, the K-NN classifier achieves the highest precision rate (100%) when the time window is equal to 18 min, but with very low recall (19%) and F1 score (35%). Thus, the one-minute time window is a proper choice for the K-NN classifier to detect the saturation attacks with detection of the highest performance in the simulated SDN environment.