## 8 Implementation and Results
### Scenario Implementation  
In the streaming scenario demonstration (Figure 11), the adversary pursues the video segments cached by gateway routers previously. Therefore, the adversary (adversary-1) can knowledge the popularity of streamed contents, recently cached by the edge routers requested by streamers (streamers-1). In the attack, the adversary only probes the target (e.g., streaming_app/videos/video-1), then the gateway routers (edge, neighbor, and away) replies with a video segment (e.g., streaming_app/videos/video-1/%00%12%34) that has been cached recently. In an ideal attack, the adversary repeats each target a minimum of four times to distinguish that a target is located (or cached) by the first NDN node or the away nodes. Additionally, other adversaries are (adversary-...) attacking other streamers (streamers-..) to conclude that the streamed contents are cached (or located) by the neighbor, edge, and away routers (or nodes). In this attack, adversaries are only determined by the popularity of the streamed content by their locations. Table 2 shows the configurations of the attack on the NDNtube-like simulation on AT&T topology. The AT&T topology has 625 nodes. A total of 156 leaves (consumers), 140 evils (adversaries), and one producer (streaming producer) were selected randomly for each one of the 10 simulation runs. The attack was applied to default CS policies (LRU, LFU, and FIFO) to evaluate the behavior of the attack (in a total of 30 runs). The adversaries have targeted the video segments named as /ndntube/videos/video-... and cached by gateway (edge) routers. In the NDNtube-like attack scenario, the adversaries, the streamers, and the producer were selected randomly for every scenario run. The results are obtained from each CS policy (LRU, LFU, and FIFO) and 30 simulation runs in total. \begin{table}
\begin{tabular}{c c c} \hline inputs & TIME & cacheHitTreshold \\ \hline  & & getCacheHitRatio() \\  & & apply\_defaultPolicy() \\ auxiliary processes & & apply\_Delay() \\  & & apply\_Random() \\  & & apply\_noCache() \\ \hline  & & delayPhase \\ attack states & ATTACK\_DETECTED & randomPhase \\  & & noCachePhase \\ \hline  & NO\_ATTACK\_DETECTED & defaultPhase \\ \hline \end{tabular}
\end{table} 
Table 1: Parameters of DaD algorithm. In this attack scenario, the adversary targets the video segments (e.g., /ndntube/videos/video-...) with a brute-force timing attack. To achieve maximized attack success, we set each request four times. Each adversary compares retrieved CRTs metrics to obtain the targets' locations and the time of the legitimate requests. In the NDNtube simulation scenario, each of the streamed content (e.g., prerecorded video and live video) is produced by a single content producer. Each of the content is signed by the producer but it is not validated by a certificate authority. The consumers send packets (100 packets/s) at a constant rate to the content video producer. The producer virtual payload size is defined as 1024 bytes for streamed content. Note that, because NDNtube simulation is only simulated (ndnSIM) for attack and countermeasures, the audio and video decoding/encoding, compression formats (e.g., MPEG-2 and H.264) can be implemented by future studies. Figure 11(b) illustrates one of the simulations run for AT&T topology. In each simulation scenario run, the routers (border nodes) were assigned randomly for the streamer producer node. In addition, the leaves nodes (namely legitimates and adversaries) were assigned randomly for the edge routers. In this network topology, the adversary nodes attack each of the gateway routers (edge) to obtain the existence of cached targets.