## 6 Results, Analysis, and Discussion  
The data gathered was generated by running the simulation a total of 1080 times, using variations in the VoIP phones used, methodology, and strength of the DoS attack. The scale of the DoS attack was controlled using variations in the number of machines used to attack the network, from zero devices (control) up to a maximum of eight. The independent \(t\)-Test was selected to compare the two independent samples (UDP phones and TCP phones) at each strength of DoS attack. Initially the \(t\)-Test is carried out on the control experiment to ensure there is no inherent variation in the values produced when using the two methodologies. This section also contains discussion and analysis of the results, which are used to evaluate the effectiveness of the implemented solution. Table 3 shows the results from a \(t\)-Test when comparing the response times gathered in the control experiment. The \(p\) values for the control experiment are both greater than 0.05, and as a result it can be concluded that there is no statistically significant difference between the mean response times for the UDP VoIP phones and the TCP VoIP phones when the network is not experiencing a DoS attack. Therefore, the statistical tests can be reliably carried out on the remaining results. It should also be noted that the quantities of packets lost were measured in the control experiment, however no voice packets were found to have failed their transmission between the two phones. When examining the results, initially using the proposed methodology does not appear to provide a significant advantage to the network. For the experiment using one DoS device (Table 4), the means for the UDP phones and the TCP phones are 0.7171 s and 0.7078 s, respectively. The \(p\) value is 0.32, and as this is greater than 0.05, the response times for the TCP phones are not significantly different to those for the UDP phones. Therefore, the null hypothesis must be accepted, and the alternative hypothesis rejected. Both the mean response time for the TCP and UDP phones is increased compared to the control experiment, indicating that the DoS attack is having an effect even with the methodology in place. This is possibly due to the structure of the network; one firewall is responsible for both networks, and as a result may be becoming congested when handling larger volumes of traffic. While there is a minor improvement in response time (\(-1.3\%\)) when using the TCP phones, it is not statistically significant at this scale of attack. However, as can be seen in Tables 5 and 6, from Experiment 2 onwards the \(p\) value is less than 0.05, suggesting the results are statistically significant. Additionally, this trend suggests that the proposed solution is far more effective when a network is facing a greater strength of attack. Based on this data it is therefore suggested that the threshold for activating the TCP phones should be increased to beyond the value of 0.7, used in the experiments, to around 0.9, where the benefit is greatly increased. Figure 9 displays a graph of the mean response times of the two types of phones during each strength of DoS attack. \begin{table}
\begin{tabular}{c c c} \hline \hline  & **UDP Response** & **TCP Response** \\  & **Time (s)** & **Time (s)** \\ \hline Mean & 0.717095047 & 0.707801941 \\ \hline Variance & 0.018879195 & 0.005781404 \\ \hline Observations & 60 & 60 \\ \hline Hypothesized Mean Difference & 0 & - \\ \hline df & 92 & - \\ \hline t Stat & 0.458389553 & - \\ \hline P (T \textless{=} t) one-tail & 0.323876787 & - \\ \hline t Critical one-tail & 1.661585397 & - \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Results, Experiment 1.