# Quarantining Malicious IoT Devices in Intelligent Sliced Mobile Networks
## 4 Results
### Detection
Figure 4 shows the effect of the threshold ratio (\(t_{r}\)) on the detection of malicious devices, for \(n=100\) devices per aggregated flow, \(s_{p}=1\,\mathrm{s}\), \(f_{m}=100\) and different \(p_{m}\). The higher the threshold, the more malicious devices get unnoticed. For low values of \(n\) and \(p_{m}\), there is a low probability for two or more malicious nodes of the same device to exist within the same aggregated flow. Under these conditions, detection drops around specific threshold ratio values for a device type of \(x\), given by Equation (1). \[\textit{threshold\_detection\_limit}(x)=1+\frac{r(x)\times(f_{m}-1)}{\sum_{ i=0}^{3}r(i)\times p_{t}(i)\times n} \tag{1}\]  
That is, there is a value for the threshold from where detection decays. Such threshold is high enough to hide the traffic of a specific type. In the same way, the number of legitimate users quarantined also decreases with the threshold, but at a slower pace, as depicted in Figure 4b. In fact, as the threshold increases, the number of legitimate nodes quarantined is \(1-(1-p_{m})^{n}\) times lower than the malicious nodes quarantined (being \(1-(1-p_{m})^{n}\) the probability that there are malicious nodes in the aggregated flow). Figure 3: Probability of detecting a flow which contains malicious devices (given by Equation (A1)) and the contribution of flows which contain malicious devices of type different than manufacturing cell (given by Equation (A2)) for \(s_{p}=1\,\mathrm{s}\), \(t_{r}=1.01\), \(f_{m}=100\) and \(p_{m}=0.01\)  
Figure 5 shows the effect of the ratio between the transmission frequencies of malicious and legitimate devices (\(f_{m}\)) on detection, for \(n=100\) devices per aggregated flow, \(s_{p}=1\) s, a \(t_{r}=1.01\) and different \(p_{m}\). Even for low deviations of the \(f_{m}\), and for a low \(p_{m}\), the detection recall for malicious nodes is high. For example, for a transmission frequency increase of \(\times 20\), over \(75\,\%\) of malicious devices are properly quarantined, whereas a transmission frequency above \(\times 125\) yields a \(100\,\%\) proper quarantining of all malicious devices in all scenarios. However, as already stated, since all the devices within an aggregated flow are quarantined, higher recalls involve more legitimate devices being sent to the Quarantine NS. Nevertheless, the amount of quarantined legitimate nodes also converges at \(f_{m}>125\). This is explained by the fact that, with this configuration, all flows containing at least one malicious device are correctly quarantined, and no flow just composed of legitimate nodes is quarantined. Therefore, the total number of quarantined flows will be bounded by the amount of malicious devices in the network, since in the worst-case scenario each malicious device belongs to a different aggregated flow in the SDN switch. However, even assuming a uniform distribution of devices among flows as in our model, the average percentage of saturation will be lower. Specifically, the expected number of malicious flows is given by the probability that a flow contains malicious devices: \(1-(1-p_{m})^{n}\). Table 2 shows the expected numbers of malicious flows. As we can observe, these values match the results in Figure 5 for \(f_{m}>125\), as expected. Figure 4: Ratio of devices quarantined as a function of the detection threshold ratio, \(t_{r}\) (\(n=100\), \(s_{p}=1\,\text{s}\), \(f_{m}=100\)) for \(p_{m}\in\{0.005,0.010,0.015,0.020,0.025\}\). Figure 5: Ratio of devices quarantined as a function of the transmission frequency of malicious devices, \(f_{m}\) (\(n=100\), \(s_{p}=1\) s, \(t_{r}=1.01\)) for \(p_{m}\in\{0.005,0.010,0.015,0.020,0.025\}\). The effect of the SDN application sampling period (\(s_{p}\)) was also analyzed through simulations with values ranging from 200 ms (as the maximum transmission period of the devices was 50 ms) to 1.5 s. Results showed no effect on the detection of flows containing malicious devices nor on the quarantine of legitimate nodes.