# Multi-Constraint and Multi-Policy Path Hopping Active Defense Method Based on SDN
## 5 Experiment and Result Analysis
### SDADM Effectiveness Experiment
#### 5.1.2 Effectiveness of Resisting Eavesdropping Attacks  
Eavesdropping attacks primarily involve acquiring communication data within the network, reassembling and analyzing it, restoring the original data, and preparing for the next step of the attack. Therefore, the amount of data stolen and the success rate of the attack are directly proportional. This section primarily analyzes the effectiveness of SDADM in resisting eavesdropping attacks by comparing the proportions of data packets detected under normal communication conditions between four different communication mechanisms: DHC [22], DPW [18], traditional no-path-hopping, and SDADM. In the simulation experiment parameter settings, the bandwidth of all links is set to 200 Mb/s. The host H1 communicates with H2 at a rate of 20 Mb/s for 5 min, and the rest of the devices communicate normally. In SDADM, the coefficient \(A\) is set to 10, \(\alpha\) is 0.5, \(\beta\) is set to 5, \(L\) is set to 10, and \(X\) is set to 20%. During the communication process, all nodes in the simulation topology are monitored through Wireshark, and the amount of data monitored at each node is compared and analyzed to assess the effectiveness of SDADM in resisting eavesdropping attacks. The experimental results are shown in Figure 4.  
In Figure 4, the \(x\) axis represents the serial number of all nodes in the topology, and the \(y\) axis represents the proportion of data packets detected at each node. As can be seen from the figure, in the case of no address hopping in traditional network communication, the communication path is fixed and always remains (OF-S1, OF-S3,OF-S7, OF-S9, OF-S12). This means that attackers can eavesdrop on complete data at any node on this path. The  
Figure 4: Comparison of effectiveness in resisting eavesdropping attacks. figure shows that 100% of the data can be detected at OF-S3, OF-S7, and OF-S9. DHC design uses two hopping algorithms. One is random path selection, which has a certain effect on reducing the data monitoring quantity of nodes but will cause some paths to be reused and nodes to reappear, resulting in too much data being forwarded by some nodes. The weighted hopping algorithm of DHC tested in this paper calculates the weight of the path based on the number of cross paths of nodes, which serves as the probability of path selection. The more cross paths, the smaller the probability of being selected, which to some extent reduces the amount of data forwarded by some nodes. However, from the experimental results, there is still a large amount of data on some key nodes. As can be seen from Figure 4, more than 50% of the data is still being forwarded on node 10, and nodes 3, 4, and 9 are also forwarding more than 40% of the data. DPW (Random Routing Defense Method Based On Dynamic Path Weight) enhances constraints on degree centrality, betweenness centrality, and closeness centrality on the basis of DHC to further reduce the probability of key nodes being selected. As can be seen from the figure, this method further reduces the data forwarding volume of node 10 on the basis of DHC, and the data forwarding volume of nodes 3, 4, and 9 also has a slight decrease. Moreover, this method implements the automatic adjustment of path weights according to network conditions, enhancing the ability to resist different attacks. In the process of path selection for SDADM, constraints are applied to key nodes and path similarity at the same time, reducing the probability of key nodes being reused and also reducing the possibility of the same or similar paths appearing repeatedly, making the data more dispersed, effectively alleviating the problem of too much data being transmitted by some nodes. As can be seen from Figure 4, the amount of data forwarded by key nodes has been significantly reduced, and for nodes with many cross paths like node 10, the amount of data forwarded is significantly lower than the previous two methods. This method makes the data in the network more dispersed and the changes in data volume between nodes more stable.