## 4 Methodology
### Feature Extraction and Data Preprocessing  
The OpenFlow packets have multiple attributes including, but not limited to, message type, packet time, packet length, and source and destination IP addresses. These packets are exchanged between the controller and OpenFlow switches. Formally, OpenFlow traffic (OF) is a collection of OpenFlow packets \(<\)\(p_{1}\), \(p_{2}\), \(\dots\), \(p_{n}\)\(>\) transmitted and captured in the course of a network (normal or attack) session, where each packet \(pi\) has the attributes \(<\)\(time,src\)\(IP\), \(dst\)\(IP\), \(OFmsg,length\)\(>\). The OpenFlow protocol v1.3 has 29 OpenFlow message that are generally divided into three categories: (1) controller-to-switch messages, generated by the SDN controller and forwarded to the OpenFlow switch for obtaining information about or changing the state of the switch (e.g., Flow-Mod); (2) asynchronous messages, initiated by the OpenFlow switch without solicitation from a controller and forwarded to the controller to notify about the new received packets and any errors (e.g., Packet-in); and (3) symmetric messages, generated from both sides, such as the Hello message. From the captured OpenFlow traffic, four features are extracted: the number of Packet-In messages, the number of Packet-Out messages, the number of Flow-Mod messages, and the number of TCP-ACK messages exchanged between the switch to the controller. The extracted features are sensitive to saturation attacks as well as hybrid saturation attacks, which are mainly a combination of different saturation attacks that target the SDN environment. The saturation and hybrid saturation attacks have a different impact on these features. Figure 3 demonstrates the impact of the UDP attack on the presence of the Packet-In and Packet-Out messages on the OpenFlow traffic. At the early stages of the attack, the number of the Packet-In messages increases significantly since the attack packets do not match the flow rules of the OpenFlow switch (i.e., table miss), which leads to generating Packet-In messages that are forwarded to the SDN controller. At the later stages of the attack, the number of Packet-In messages will be dropped followed by an increase in Packet-Out messages generated by the controller as a response to the generated Packet-In message at the early stages of the attack. It is highly important to note here that the SDN controller cannot process every Packet-In message in timely manner and generate a Packet-Out message due to the negative impact of the attack on the SDN environment computational resources. Table 3 explains the impact of TCP-SARFU, UDP, TCP-SYN, ICMP, and IP spoofing attacks on each feature. Central to detecting saturation attacks is determining the proper time window. Thus, we analyze the impact of various time windows on the prediction results of the K-NN, NB, and SVM classifiers. From the captured OpenFlow traffic, we extracted a separate dataset for each different time-window. This is done in both simulated and physical SDN environments. The time window of the extracted dataset ranges from one minute to the \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Environment Type** & **Traffic Type** & **Num. of Session** & **Duration per Session** & **Duration** & **Size** \\ \hline \multirow{3}{*}{Physical Environment} & Benign Traffic & 104 h & 1–4 h & 137 h & 250 GB \\ \cline{2-5}  & Attack Traffic & 31 & 30 min & 15.5 min & 50 GB \\ \hline \multirow{3}{*}{Simulated Environment} & Benign Traffic & 100 & 1 h & 100 h & 143 GB \\ \cline{2-5}  & Attack Traffic & 31 & 20 min & 10.3 h & 100 GB \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Physical and simulated OpenFlow traffic description. attack duration. In other words, we extract the datasets from the collected OpenFlow traffic, where the duration of each sample inside the extracted dataset is equal to the defined time window. **Dataset extraction process. ** Algorithm 1 demonstrates the process of extracting datasets from the captured OpenFlow traffic.