## 7 Conclusions  
In this article, we test and analyse the SECOD algorithm to protect SDN-based IoT network in the real testbed. As IoT has a vast number of applications across different areas, this makes IoT prone to DDoS attacks, which have a huge impact on the SDN-based IoT networks. In order to define the metric of DDoS attacks in the IoT network, studying different features of IoT traffic is the first step. Another challenge is to find out the bottleneck of defence in particular if the control plane or data plane suffers. Periodic and random IoT traffic are emulated in the real test bed, and the results show the following.  
* Random traffic (UDP or TCP) is more affected during DDoS attacks. Therefore, we can conclude that IoT event-trigger applications are more vulnerable to attacks than periodical ones.
* Metrics of OpenFlow and TCP connections can play an essential part in keeping at least a minimum performance under a DDoS attack. Therefore, this metric can be tuned based on the characteristics of IoT traffic that the network is supplying.
* Resources of control plane (controllers) play a minor role during DDoS attacks, if the data plane (switches) resources are already compromised.
* The SECOD algorithm is able to block DDoS attacks in the SDN-based IoT network, where traffic behaves like normal circumstances even under DDoS attacks; however, the performance in protecting random UDP traffic still requires improvements.  
For the sake of the feature of IoT applications, DDoS attacks can be detected much easier than in the pure traditional or SDN networks, especially on the dedicated IoT network slices. We demonstrate that algorithms for DDoS detection and defence like SECOD can be regulated and improved, similar to SECOM, in order to better adapt to the predictable dynamics of IoT traffic. SECOD and SECOM provide solutions for administrators under different environments; SECOD is more energy efficient than SECOM, but SECOM has a quicker response to DDoS attacks. Both of them are easy to implement and maintain.  
The limitation of the proposed algorithm is that it is only able to work under reactive mode, because it relies on the Packet_In message. Furthermore, if the attacker changes or spoofs source IP address, it will be difficult to track. It is also worth noting that if we consider a network topology with core, aggregation and access layers, SECOD best suits the access layer as a lightweight solution against DDoS attacks, while for aggregation or core layer deployment, more features and modifications are required. As future work, we will study the behaviour of IoT subscribers to refine the definition of threshold in different applications, and verify the output with real IoT devices and traffic based on smart city applications.  
Conceptualization, S.W., K.G. and K.S.; methodology, S.W. and K.G.; software, S.W.; formal analysis, S.W.; investigation, S.W.; resources, P.Z.; data curation, S.W.; writing--original draft preparation, S.W.; writing--review and editing, K.G., K.S., M.R.A. and G.R.; supervision, K.G. and K.S. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.  
The data presented in this study are available on request from the corresponding author. The data are not publicly available due to privacy.  
[PERSON] is supported by the Australian Government Research Training Program Scholarship.  
The authors declare no conflict of interest.