## 4 Experimental Results
### An Example of an Attack Simulation Model against SDN  
After the formation of the simulation stand, the description of the logical structure of the SDN and the CAs, it is necessary to proceed to the formation of the simulation model of CAs. Consider an example of a simulation model of the CA against SDN. To do this, each stage of the attack implementation process is characterized by an average execution time. To conduct experiments and obtain the parameters of the average time for the CA stages, it is proposed to use the tools EVE-NG of virtual modeling of computer networks. \begin{table}
\begin{tabular}{c c c} \hline \hline
**No.** & **Device (Software Product) Name** & **Note** \\ \hline \multicolumn{3}{c}{Switches and routers} \\ \hline
1 & JuniperSRX-240 (QEMU) & Network device acting as a border router \\ \hline
2 & Dionis-NX (QEMU) & Network device acting as a firewall \\ \hline
3 & Cisco3845 (QEMU) & Simulating the public communication system operation \\ \hline
4 & OpenvSwitch (Linux Ubuntu) & Software SDN Router \\ \hline \multicolumn{3}{c}{Tools for simulating information exchange} \\ \hline
5 & Linux Ubuntu & Operating system \\ \hline
6 & Lifesize & Video conferencing \\ \hline
7 & Proteus-SP & IP telephone exchange \\ \hline
8 & SIP-T22R & IP telephone \\ \hline
9 & Runos 2.0 & SDN controller \\ \hline \multicolumn{3}{c}{Modeling environment and auxiliary tools} \\ \hline
10 & EVE-NG & Data network simulation environment \\ \hline
11 & NFsen & A tool for collecting information from network devices about information flows \\ \hline
12 & Zabbix 3.4 & Monitoring tool \\ \hline
13 & Wireshark & Means of intercepting traffic in the data transmission network \\ \hline
14 & VMware & Virtualization environment for running guest operating systems \\ \hline \hline \end{tabular}
\end{table} 
Table 8: List of used software products. To carry out a remote CA, an attacker can be located at any point that has a connection to a public communication system. The CA stages can be summarized in the diagram shown in Figure 10.  
The choice of the CA type is influenced by two main factors (Figure 11):  
* The goals and objectives of the upcoming CA;
* Information about the data transmission network, on which CA implementation is based on. Thus, the first factor for creating a CA simulation model on SDN is the attack goals and objectives. Let us say the goal of the CA is to obtain control or partial control of the data network to collect and analyze the transmitted traffic. One type of CA in SDN to achieve this kind of goal is a network topology spoofing attack. The second factor is the parameters that characterize the operation of SDN devices. These include standard IP/MAC addresses of network devices, unique numbers (UUID) of a software switch/controller, an SSL key and others. Figure 12 shows the main parameters of OpenVSwitch v. 2.9.8. Having received the necessary data, the attacker can conduct a CA by making all the necessary settings for the device/devices from which it is supposed to carry out CAs such as \"Substitution of network topology\" (Figure 13). The attack implementation steps shown in this figure correspond to those in Table 9.  
Figure 11: Main factors affecting the type of implemented CAs against SDN. Figure 12: Basic parameters of soft switch, OpenvSwitch v. 2.9.8. Figure 10: Generalized scheme of CA stages. During the experiments, network traffic data were obtained. The result of the CA was the work of an attacker impersonating a trusted network device using identification data obtained by technical computer intelligence. To obtain adequate data in the simulation model, the model time and number of experiments should be determined. When one is conducting experiments using a simulation model, the model time will be the time spent conducting the studied CA against the SDN. It is logical that with each \(i\)-th experiment, its implementation time will be shorter than the previous one, until it reaches the value of the minimum execution time.