## 5 Results  
### Detection and Mitigation  
As described in the previous section, the controller/orchestrator integrates two modules designed for attack detection and mitigation. These modules are interlinked as the mitigation process necessitates detailed flow information, including source IP, source port, destination IP, destination port, and the attacking protocol. The detection module operates as a thread, routinely issuing requests to the OpenFlow switch to gather statistical information.  
To obtain a response from the switch, an event handler was created to capture the messages containing the statistics' reply. These statistics undergo analysis to extract the packet's source and destination address, as well as the TCP or UDP source and destination port, to tally the different analyzed flows. Upon completing the flow analysis, entropy calculation ensues. Entropy is utilized for detecting Denial of Service (DoS) attacks by assessing statistical attributes within the packet header. Specifically, the analysis relies on comparing entropy across successive packet samples to identify an attack and can be defined as Equation (1):  
\[E=-\sum_{i=1}^{n}p_{i}log_{2}p_{i} \tag{1}\]  
where \(E\) is the entropy, \(n\) is the number of elements detected in the flow analysis, and \(p_{i}\) is the probability of finding the \(i\)-\(th\) element in the conjunction of elements detected in the analysis. The application of entropy allows for the analysis of multiple variables within a flow by calculating the probability that the next packets encountered have similar information that the others processed previously. The attack performed in this experiment is a UDP flood attack by the malicious node, as a result of which the entropy of the flow sent by that node will be significantly reduced once packets of the same type start to be sent to the victim over the network. Once the entropy is calculated, the detection algorithm is executed. The algorithm is based on Equations (2) to (4).  
\[lower-lim=\overline{x_{p}}-precision*\sigma_{p} \tag{2}\]  
\[upper-lim=\overline{x_{p}}+precision*\sigma_{p} \tag{3}\]  
\[Attack=\begin{cases}false&if\quad lower-lim\leq x\leq upper-lim\\ true&otherwise\end{cases} \tag{4}\]  
where \(\overline{x_{p}}\) is the mean value of the analyzed elements, and _precision_ is the value used to define the precision in the detection algorithm. In this case, the values used for precision are 68% for low precision, 95% for medium precision, and 99.7% for high precision. Finally, \(\sigma_{p}\) is the standard deviation.  
If an attack is detected, the controller/orchestrator searches a database containing information about the Docker cluster to select the server capable of efficiently implementing the NFV function. Once the server is chosen, the controller opens a secure channel to deploy the NFV in a Docker container. The deployment is carried out using the Dockerfile descriptor. This file describes the NFV function and the Docker's behavior. Algorithm 1 shows an example of a Dockerfile.  
The Dockerfile defines the rules with which the Docker will be launched. Once the Docker container is built, the interfaces are created and the bridge between them is established. All of this is deployed on the chosen server from the Docker cluster. The controller, after completing the deployment phase, modifies the forwarding tables of the switches involved in the DoS attack communication to mitigate it. With this mechanism, the switches receiving the attack only need to forward the packets to the output port, and the attack is mitigated using a server designed to absorb it without causing a DoS on the target node chosen by the attacker. In this case, the destination is the firewall deployed as an NFV function, a software implementation of a firewall with relevant rules to filter malicious traffic.  
```
Firewall allowing traffic # from port 80 FROM base ENTRYPOINT ifinit && \ brinit && \ iptables -A FORWARD -p tcp && \ -dport 80 -j ACCEPT && \ iptables -A FORWARD -j DROP && \ /bin/bash
```  
**Algorithm 1** Example Dockerfile