# Multi-Constraint and Multi-Policy Path Hopping Active Defense Method Based on SDN
## 5 Experiment and Result Analysis
### SDADM Effectiveness Experiment
#### 5.1.3 Effectiveness of Resisting Link-Flooding Attacks  
Link-flooding attacks aim to cause link overload, making it impossible for legitimate network traffic to pass normally, thereby affecting the normal operation of the network. In the experiment, Hping3 [23] is used to send UDP packets at a rate of 85 Mb/S to the two links OF-S3-OF-S7 and OF-S7-OF-S9 to simulate flooding attacks lasting for 10 min. The bandwidth of all links is set to 100 Mb/s, and the host H1 sends data packets to H2 at a rate of 10 Mb/s, with all other hosts suspending communication to ensure that only H1 and H2 are communicating in the network. By comparing the remaining bandwidth of the path at different communication times under the four communication mechanisms of no address hopping, DHC [22], dynamic routing random hopping [15], and SDADM, the effectiveness of SDADM in resisting flooding attacks is analyzed. The experimental results are shown in Figure 5.  
In Figure 5, the x axis represents the communication time of the host, and the y axis represents the remaining bandwidth of the communication path at that moment. As can be seen from the figure, when there is no path hopping in traditional networks, the communication path remains unchanged. When facing link-flooding attacks, it cannot effectively defend. During the host's communication time, the remaining bandwidth of the link is always 5%. It is conceivable that when the attacker increases the attack flow, the bandwidth of this path will be exhausted and unable to provide normal services. DHC uses the method of weighted paths for path hopping, taking the number of cross paths of nodes as weights as the probability of path selection, which to some extent alleviates the impact of link-flooding attacks. However, this method of selecting a path based on key nodes does not consider the factor of path bandwidth and uses a random selection method. Therefore, paths containing attack links will appear in the process of multiple hops, and the link-flooding attack has not been completely avoided. As shown in the figure, at times 2, 4, and 8, the remaining bandwidth of the path is still 5%, and there is still a risk of being attacked and unable to provide normal services. Dynamic routing random hopping is similar to DHC, with key nodes as constraints. The more cross paths of key nodes, the smaller the weight and the smaller the probability of being selected. The process of path selection still does not consider the factor of path bandwidth. However, this method introduces constraints on the Jaccard distance of the path and the timing of path use, reducing the probability of path reuse and the occurrence of key nodes to a certain extent. Therefore, compared with DHC, this method has certain advantages in path selection, reducing the probability of selecting paths containing attack links, but it still cannot completely avoid link-flooding attacks. SDADM adopts a dual-strategy path selection algorithm. When a link-flooding attack occurs, when the remaining bandwidth of the current communication path is lower than the threshold, it will automatically switch the path selection algorithm according to the remaining bandwidth weight of the path as the selection probability, effectively avoiding the path containing the attacked link. The experimental results also prove the effectiveness of this method.