# Quarantining Malicious IoT Devices in Intelligent Sliced Mobile Networks
## 4 Results
### Detection
In a real setup, this procedure would be performed by an SDN application by directly sampling the flow tables of the SDN switches every \(s_{p}\) seconds to obtain the throughput. The expected aggregated traffic was computed as the sum of the average data rates of the devices. If the aggregated data rate exceeded the expected one in a ratio higher than \(t_{r}\), the flow was tagged as suspicious and their devices diverted to the Quarantine NS for further inspection. Figure 2 illustrates the percentage of devices that were quarantined (that is, the number of devices in flows with abnormal traffic) as a function of the probability of a device to be compromised or malicious. Traffic was considered anomalous if it exceeded the expected regular rate by 1% (i.e., \(t_{r}=1.01\)). Malicious devices transmitted 100 times more data than legitimate ones(i.e., \(f_{m}=100\)) and the SDN application sampling period \(s_{p}\) was set to 1 s. In this scenario, recall is significant even for small populations of malicious devices in large aggregated flows. In fact, more than 75% of the malicious devices are quarantined for a \(p_{m}\) higher than 0.001 for any number of devices per aggregated flow. As expected, recall increases with \(p_{m}\). All the devices in a suspicious aggregated flow, which may include many legitimate devices, are quarantined. Thus, the number of legitimate nodes diverted to the Quarantine NS increases with the number of aggregated devices (\(n\)). The fewer devices are aggregated per flow, the greater the accuracy of the system. A closer observation of Figure 1(a) reveals that the effect of the number of devices aggregated in a flow (\(n\)) on the detection of malicious devices in the simulated scenario is not intuitive. Any malicious device is detected for \(n=50\) devices/flow, but then the ratio of malicious devices detected decreases as the number of devices per flow grows up to 150. After that value, detection improves as \(n\) increases. The cause of this effect is as follows. For a low value of \(n\), the probability that there is no more than one malicious device within the aggregated flow is high (note that Figure 1(a) only evaluates flows containing malicious devices). However, within such reduced set of nodes, the malicious device is easily detected. At a certain \(n\), flows containing only a manufacturing cell type malicious node (the category with the lowest rate) begin to go unnoticed and, consequently, detection drops. But, on the other side, increasing the size of the aggregated flow also decreases the probability of flows containing only malicious nodes of manufacturing cell type, thus raising the detection (other types of malicious nodes are easier to detect because of their higher rate). As an example to better understand this effect, we have analytically studied the probability of detecting a flow which contains malicious devices as a function of \(n\) in the scenario described in Figure 1(a) for a \(p_{m}=0.01\). Figure 3 shows the probability of detecting a flow which contains malicious devices in this scenario, and the contribution to this probability by flows which contain some malicious device of a type different than manufacturing cell. The first we can observe is that the values at 50, 100,  
Figure 2: Ratio of devices quarantined as a function of the probability of a device to be malicious, \(p_{m}\) (\(s_{p}=1\)s, \(t_{r}=1.01\), \(f_{m}=100\)), for \(n\in\{50,100,150,200,250\}\). 150, 200 and 250 devices per flow match with the experimental results in Figure 2a for a \(p_{m}=0.01\). As we can see, the probability of detecting a flow with malicious devices is 1 for \(n<70\) devices per flow. Then, this value starts decreasing because the probability of detecting a flow containing only malicious devices of manufacturing cell type decreases. On the other hand, the contribution of flows with malicious devices raises with \(n\), validating our previous arguments. Analytical formulas used for studying this scenario are elaborated in Appendix A.1.