# Quarantining Malicious IoT Devices in Intelligent Sliced Mobile Networks
## 4 Results
### Detection  
We conducted simulations to evaluate the performance of the solution for detecting IoT DDoS attacks in mobile networks described in Section 3.1. The objective of these simulations was to estimate the probability of detecting malicious nodes within a set of devices corresponding to the same flow in the routing table of an SDN switch, which are perceived by the operator as a single unit, based on the comparison between issued and expected traffic of the devices in different scenarios. To represent a realistic scenario and for simplicity the category of factory automation devices in [30] was considered in the simulations, as reproduced in Table 1. The behaviour of the corresponding IoT devices is highly predictable, since they send data frames with the same format and length at fixed periodicity [31; 32]. This allows identifying malicious behavior by simply analyzing traffic deviations from the expected pattern. Our approach could be easily extended to other categories, even to categories identified in real time with Machine Learning (ML) or other techniques [37]. Different scenarios were simulated, each of them characterized by the following input parameters:  
* \(n\): Number of devices per flow. * \(p_{m}\): Probability of a device to be malicious (independent of other devices). * \(f_{m}\): Ratio between the transmission frequency of a malicious device and a legitimate device. * \(t_{r}\): Ratio between the threshold throughput, from which flows are detected as suspicious, and the volume of throughput expected for the current scenario. * \(p_{t}(i)\): Probability of a device to be of type \(i\) (independent of other devices). * \(r(i)\): Data rate of type \(i\) legitimate devices. * \(s_{p}\): Sampling period of the SDN application. * \(t_{p}(i)\): Transmission period of a type \(i\) legitimate device. We performed \(10^{5}\) simulation rounds for each scenario, resulting in average percentages of malicious along with legitimate devices marked as suspicious under the conditions of each case. A custom simulator was developed to analyze the aforementioned scenarios. The source code of this tool has been released as open-source and is publicly available at [38]. On each round \(n\) factory automation devices generate an aggregated flow that matches an entry in the flow table in an access SDN switch. The behaviour of each node is defined by its device type, which is selected by randomly picking one of the categories in Table 1 (\(\{0,1,2,3\}\)) following a discrete uniform distribution (i.e., \(p_{t}(i)=0.25\ \forall i\in\{0,1,2,3\}\)). Then, malicious devices were independently tagged according to a Bernoulli Be(\(p_{m}\)) distribution, and configured to increase \(f_{m}\) times the transmission frequency of legitimate devices to emulate a DDoS attack [34; 39]. To simulate the traffic, the devices in the aggregated flow transmitted independently and asynchronously in an ideal non-saturated channel where data frames were always transmitted successfully. To emulate this behaviour, the arrival time of the first transmission since the beginning of the simulation followed a uniform U(0,\(t_{p}(i)\)) distribution. Under these assumptions, the aggregated data rate was measured as the sum of the data traffic generated by the aggregated flow, by counting the number and length of frames transmitted by each device (which depends on their transmission \begin{table}
\begin{tabular}{l c c c c c c c}
**Use Case** & & & & & & & & \\ Manufacturing cell & 5 & \(10^{9}\) & 50 & 15 & 0.33 to 3 & 50 to 100 & \textless{}30 \\ Machine tools & 0.25 & \(10^{9}\) & 0.5 & 50 & 0.33 to 3 & 50 to 100 & \textless{}30 \\ Printing machines & 1 & \(10^{9}\) & 2 & 30 & 0.33 to 3 & 50 to 100 & \textless{}30 \\ Packaging machines & 25 & \(10^{9}\) & 5 & 15 & 0.33 to 3 & 50 to 100 & \textless{}30 \\ \hline \end{tabular}
\end{table} 
Table 1: Network characteristics of IoT devices in factory automation. frequency and frame data size) during the SDN application sampling period \(s_{p}\).