# Performance Analysis of Software-Defined Networks to Mitigate Private VLAN Attacks
## 6 Conclusions  
In this paper, two strategies to mitigate the PVLAN attack based on ACLs and SDNs were analysed and compared. Both strategies were tested in scenarios with different two-level network designs and with network devices with different levels of performance. Several parameters such as CPU and memory usage, round-trip time, packet loss, and power consumption were evaluated. The results showed that the proposed mitigation strategy had an impact on these parameters. The conventional ACL-based approach tended to increase CPU consumption in higher-level devices, while the SDN-based approach did so in lower-level devices, in a more balanced way. Memory usage also showed this behaviour, but the difference between the two approaches could be considered negligible. In terms of network performance from the perspective of users, there were no significant differences between mitigation strategies. However, there was a very large difference in an oversubscribed network scenario if ACLs were placed incorrectly. The effect was a significant increase in the round-trip time, while packet loss quickly rose to 50%. It is also worth noting that both scenarios had a limitation, as no additional measures such as a firewall, an intrusion detection system (IDS), or an intrusion prevention system (IPS) were in place during testing. However, the inclusion of additional systems would not affect the performance analysis carried out in this paper. Therefore, in an oversubscribed scenario, the SDN approach prevents the network administrator from making mistakes in the configuration of the ACLs, specifically, in which interface to place them, so the SDN approach ensures proper operation and performance. Furthermore, the use of an SDN-based mitigation approach allows for a wider range of deception strategies. Not only does this approach rely on blocking forbidden communications, but malicious packets can also be sent to a honeypot, or even sent back to the attacker by setting the inbound port as the outbound port in the action list regarding the PVLAN attack flow in the flow table. Additional benefits of using the SDN approach are that resource consumption can be balanced at the access level, so bottlenecks can be avoided, and that configuration is simpler and less prone to errors than using an ACL approach. Future work will focus on comparing the performance of SDNs with conventional network mitigation strategies to protect corporate networks against other common types of attacks. Examples are SDN-based alternatives to implement defensive strategies at the access level switches to protect against flooding or to avoid sending unicast frames to unknown MACs. Similarly, the development of SDN-based defensive strategies for other network environments, such as IoT networks, will be explored. In particular, research is underway on a system that detects IoT devices that are deployed on different ports than expected in a switched environment, and correcting this configuration. The system makes it possible to modify the configuration of the switch ports if the device is well known, to accommodate it if the device is new, or to exclude it from the network if any anomalous behaviour is detected. Figure 14: SDNs, inbound ACLs, and outbound ACL comparison. **Author Contributions:** Conceptualisation, P.N., D.A. and F.G.B. ; design, P.N., D.A., F.G.B., J.C.G., C.T.G. and D.G.-C.; research, P.N., D.A. ; methodology, P.N., D.A., F.G.B., J.C.G. and D.G.-C.; resources, P.N., F.G.B., J.C.G. and D.G.-C.; testing, P.N., D.A., C.T.G. and J.C.G. ; data curation, P.N., D.A., F.G.B., J.C.G., C.T.G. and D.G.-C.; writing, P.N., D.A., F.G.B., J.C.G., C.T.G. and D.G.-C. All authors have read and agreed to the published version of the manuscript. **Funding:** This research received no external funding. **Institutional Review Board Statement:** Not applicable. **Informed Consent Statement:** Not applicable. **Data Availability Statement:** The data used to support the findings of this study are available from the corresponding author upon request.