## 5 Results
### Testbed and Results  
The scenario used is presented in Figure 7, and it is built on the top of Containernet and Docker servers infrastructure. As depicted in the figure, each infrastructure is deployed in a physical server interconnected by an Ethernet network. The network was deployed in Containernet because it offers a fully virtualized environment based on Docker containers. These containers utilize sophisticated isolation features (e.g., Mount, UTS, IPC, PID, Network) to achieve a superior degree of sandboxing. This enhanced isolation capability is crucial to measure the resources used by the analyzed scenario. Containernet is a fork of the widely recognized network emulator Mininet. While Mininet efficiently emulates specific use cases, its inherent limitations due to it not fully isolating emulated hosts have been a crucial issue for election. In the scenario, a real trace with legitimate network traffic is inserted to the scenario to generate background traffic and make it difficult for the detection module of the algorithm. At around fifteen seconds, the attack is produced, and the attacker starts to generate illegitimate network traffic and send it to the victim. As can be observed in Figure 8a, the throughput is increased very quickly. Figure 7: Scenario used to the experimental results. In this scenario, a real network traffic trace, obtained from project BEBA, is introduced to the environment to generate background traffic. This will complicate the algorithm's detection process and validate the process of attack mitigation. Around fifteen seconds after the beginning of the scenario, the attacker starts to generate illegitimate network traffic and send it to the victim. As depicted in Figure 8a, there is a rapid surge in throughput observed when the attack is started. In this scenario, the network does not implement any mechanism to mitigate the attack; hence, the throughput sent to the network is maintained during the experiment. As can be observed, the experiment was repeated 15 times to avoid random events in the scenario. Compared with the experiment with a mitigation mechanism based on the entropy analysis of the flows, the average throughput reached in the network is reduced by around 8%, and the attack is mitigated in less than 5 s, as can be observed in Figure 8b. At around the eighteenth second, the traffic starts to decrease in the network. The entropy analysis, shown in Figure 9, studies the information stored in the controller and demonstrates the evolution of the entropy parameter in the source and destination IP address, which are the source and destination port of the attacking flow. As can be seen, when the attack is launched, the entropy level drops below the minimum, and the controller triggers the mitigation by redirecting the traffic over the network to the deployed Docker with the firewall service, which filters the packets belonging to the attack and leaves the rest of the packets that are sent and are legitimate. Once the invalid traffic is filtered (around the twentieth second), the entropy returns to normal levels as the amount of packets sent to the victim has decreased. Figure 8: Network throughput: (**a**) scenario without any mitigation and (**b**) scenario with the proposed mitigation mechanism. Figure 9: Entropy for each analyzed parameter. Another of the most important parameters evaluated in this article is the average amount of CPU used in attacks, as shown in Figure 10a,b. The first shows the average CPU usage without mitigation, which is a continuous use throughout the experiment due to the need for the devices to receive the sent packets, process them, and forward them to the next hop, or attend to requests in case of a victim node. On the contrary, when the mitigation mechanism is active, it can be observed that it never reaches 100%, and the maximum CPU usage is achieved within seconds of the attack until it is detected. Additionally, it can be observed that the average CPU usage decreases once the network traffic is redirected to the virtualized NFV function.