# Mitigating Timing Side-Channel Attacks in Software-Defined Networks: Detection and Response +
## 4 Experiments and Results
The temporary rule of the response module is observed using the feedback module of the solution. We do this by developing a Python-based application that leverages 'OFFFlowStatsRequest', which is a feature of the OpenFlow protocol. We generated probe traffic from the same host. In this case, the traffic is blocked. This is due to the temporary customised rule. We tested the traffic to other networks and protocols to ensure that the flow applied only dropped the probe attempts. The results in Figure 9 illustrate that only the customised rule is accurate. Probe traffic using the ICMP protocol was dropped from specific destinations. Other hosts connected to the same OpenFlow switch can also reach this destination. The results demonstrate that all other traffic from that host is not impacted by this temporary customised rule. Next, the feedback module monitors the statistics of temporary rules. The statistics show that temporary rule registers were hit. This implies that the adversary remains malicious and requires a permanent solution. In this case, the module provides feedback  
Figure 8: Performance Metrics of Machine Learning Algorithms: F1 Score, Precision, and Recall. to the response module to add a permanent customised flow to permanently block the adversary's probe at the switch level. We repeated these steps to simulate a scenario in which we validated the update of the database using the feedback module. In this step, we observed the OpenFlow switch entries to verify that the switch has a temporary rule from the response module. We let the idle_timeout expire and did not generate another probe from the same host. The feedback module sends the source and other parameters to the database and we observe that this process creates new entries in our database. In Phase B, the probe was launched again from the second host. As the source has already been detected in the previous stage, the data analysis module marks it as having been detected previously. This is sent to the response module to form a permanently customised rule. The response solution forms a customised flow based on the detected source, destination, and protocol. It instructs the controller to send this flow to its switch. This rule is now a permanent rule which blocks only the specific probing traffic from the controller, instead of adding it. The data depicted in Figure 10 suggest that the response time of the previously identified malicious machines remains relatively stable and does not change significantly. The efficiency of these requests can be attributed to their streamlined process, which includes the data analysis and response phases of the response mechanism. By reducing the processing of sources blacklisted in the past, the data analysis component enables prompt response measures. The results in Figure 10 show that, on average, only an additional 10.41 ms of processing time was added to the response time. This value is negligible because the process ensures that the flow sent to the switch is granular and does not block the entire traffic from the detected source. To test the effectiveness of the permanent customised drop rule, we generated probe traffic from hosts 1, 3, 5 and 7 connected to switches 1, 2, 3 and 4, respectively. Timing probes are generated from these hosts with variable destination addresses until a temporary customised drop rule is obtained. We note the destination addresses and address ranges of these probes. We stop the probes and let the 'idle_timeout' expire. This implies that the response solution has learned about the probing packets; however, there is no rule in the switches to drop these probe packets. After the 'idle_timeout' for the temporary flow rule expires, we regenerate the probes from the same sources to the same destinations which were used previously. The response solution immediately responds using a customised permanent drop rule. We evaluated the accuracy of these flows by generating ICMP, TCP,  
Figure 9: Selective Traffic Blocking with Customized Rule Implementation.