# Performance Analysis of Software-Defined Networks to Mitigate Private VLAN Attacks
## 1 Introduction  
The number of services and interconnected devices has risen significantly in recent years due to digital transformation and the advent of new technologies such as cloud computing and the Internet of Things (IoT). Therefore, network administrators must cope with several security threats that can be unintentionally introduced within the corporate network, leading to vulnerable exposed systems and services. The tasks performed by network administrators tend to be complex and usually prone to errors, thus compromising network security. In fact, some attack techniques leveraging non-existent or bad configurations in layers 2 and 3 of the Open Systems Interconnection (OSI) model have been traditionally used by cyber adversaries [1, 2]. The defence-in-depth (DiD) methodology is a defensive approach traditionally implemented by network administrators to design and build secure networks by layering and segmenting them [3]. Network segmentation relies on organising corporate resources in zones with similar security requirements [4, 5]. Then, a firewall enforcing restrictive policies is deployed between zones. Typically, segmentation is implemented in layer 2 using standard virtual local area networks (VLANs) or private virtual local area networks(PVLANs). Although DiD may well suit the needs of a conventional corporate network with reduced size, it is not easily scalable to larger environments since it is difficult to manage, requires extensive skill sets, and can be extremely costly [6]. Therefore, some authors state that this defensive model composed of several layers representing different security tactics is outdated [7]. Software-defined networks (SDNs) are emerging technologies with a wide variety of innovative application areas such as network virtualisation (NV) in cloud environments [8], time-sensitive networking (TSN) [9], vehicular ad hoc networks (VANETs) [10], and distributed deep learning (DDL) [11]. Within the area of security, SDNs may help reduce the management complexity of DiD in large corporate networks, for example, when performing network segmentation [12; 13; 14; 15]. SDNs introduce a new networking paradigm to manage data and control planes separately. SDNs are based in a central node, called the SDN controller, which has full knowledge of the data plane. The data plane is composed of network devices, which are in charge of commuting or routing each packet properly. In addition, the SDN controller is responsible for the control plane, so it manages the deployment, organisation, and behaviour of the elements of the data plane. To do so, the SDN controller performs software-based decisions, which implies expanding the application of dynamic data-flow tables and rules to the rest of the network devices. As the SDN controller is a programmable entity, advanced security control and deceptive strategies can be implemented to increase network security. Since the rise of SDNs, numerous research works have been published comparing the conventional networking approach with the SDN-based approach. The results of these studies show that SDNs have lower delay and jitter, as well as a higher throughput than conventional networks [16]. In addition, routing convergence time with large topologies is shorter in SDNs than in conventional networks, indicating that SDNs converge faster [17]. Following this research topic, it is also interesting to study how the implementation of security measures may benefit from the SDN approach in terms of network performance and resource usage. In this research, a corporate networking scenario using PVLANs is emulated using two mitigation strategies: a conventional approach and an SDN-based approach. PVLANs are secured in the conventional approach by configuring access control lists (ACLs) in the gateway of the corporate network. In contrast, in the SDN-based approach, security rules are configured in the switches of the LAN segment.