## 5 Experiment Results and Discussions
### The Impact of Time Window Variation on the Detection Performance of Machine Learning Classifiers  
Based on the results of the experiments in Section 5, the time window has a significant impact on the detection performance of our classifiers. A longer time window led to a decrease in the overall results of our evaluation metrics and detection performance. Figure 4a shows the metric values from the K-NN classifier applied to the physical environment. The precision ratios decrease as the time window increases. The recall ratios increase slightly and the F1 scores decrease as the time window is increased, but the overall detection performance of the K-NN classifier decreases. Similarly, the SVM classifier detection results in the physical and simulated experiments showing a similar behavior to the K-NN classifier. Figures 4b and 5b show the evaluation results of the SVM experiments on the physical and simulated environments, respectively. The precision rates, recall rates, and F1 score rates decrease when the time window increases. The same behavior is confirmed by NB trained models, in which their detection performance declines when the length of the time window is increased (see Figures 4c and 5c).  
To further investigate the role of the time window length on the detection results of the supervised classifiers, we perform the false negative analysis. The main objective of this analysis is to allocate all the misclassified samples by the trained classifiers as well as the corresponding time slot of these samples. During the false-negative analysis, we extract the attacks samples and the associated time slot for each sample from the testing datasets. Then, we fed all the attack samples to the trained models of K-NN, SVM, and NB for prediction. The results of the false-negative analysis revealed that the majority of the false negatives happened at the end of the saturation attack. As depicted in Figure 4, the precision, recall, and F-1 score of the trained models decreased dramatically when the time window was equal to 15 min or longer. This is due to the status of the SDN environment. Basically, at the initial phase of the attack, the controller and the OpenFlow switches have enough capacity to process the table miss packets. Furthermore, the OpenFlow channel has enough bandwidth to transfer OpenFlow messages, which led to a huge increase in the numbers of Packet-In, Flow-Mod, Packet-Out, and TCP-ACK messages. Therefore, the trained classifiers can identify the attack samples with high recall, precision, and F-1 score.  
Later, when the attack takes-over the SDN environment, the computational resources of the controller and the OpenFlow switch were consumed. In this case, they do not have the required resources to process malicious traffic. Thus, the occurrences of Packet-In, Packet-Out, Flow-Mod, and TCP-ACK messages in the malicious traffic will be similar to their occurrences in the normal traffic. As a result, the false negatives are increased since the trained classifiers classify the attack samples as normal ones, which reduces the recall ratio or increases the false positives that decrease the precision ratio of the trained classifiers.