## 6 Results and Discussions
### Network Performance Behaviour under DDoS Attacks with SECOD Activated  
Finally, we activated the SECOD algorithm in order to investigate the network performance. The Receiver Operating Characteristic (ROC) curve is shown in Figure 10; both normal and attack states have been repeated for 100 times, the predefined threshold of a port is 100, where positive is normal state in the test. From the results in Figure 11, it can be seen that both TCP and UDP traffic are able to reach the IoT-DS during a DDoS attack. With the aid of SECOD, 100% of TCP requests and 99% of periodic UDP requests are received by the receiver; however, 27% of random UDP requests are dropped in the middle of transmission. The average delivery rate of TCP packets and periodic UDP packets are 95% and 99%, respectively, which is almost the same as normal state. For random UDP  
Figure 8: SDN-based IoT network performance under DDoS attack conditions with Idle_Timeout (120 s) and initial TCP window size (5000). Figure 9: Performance of SDN-based IoT network under DDoS attack conditions with P-CON and RPi Controller (R-PI CON). packets, the delivery rate is 76%. The performance of SECOD in a large network topology is verified in the Mininet, it is working properly with more users, more attackers and a higher bandwidth than in the hardware emulation. Although the physical testbed consists of fewer devices, it poses more issues, such as the unexpected output of UDP traffic, from real implementation. The available bandwidth in the Mininet in Figure 4 is relatively more smooth than in the real testbed in Figure 11, because the network environment in the simulator is stable, and all the network resources are managed as a whole by the laptop to balance and meet the requirement from each component. Nevertheless, the results of running SECOD in both the simulator and physical devices build confidence in protecting a large real network. Note that packet loss happens frequently in the random UDP traffic. However, the performance of periodical UDP traffic is perfect. Furthermore, we find that random traffic has worse performance than periodical traffic during DDoS attack. Even though periodical traffic has to pass through a longer route to the server (from IoT-DAG-1 to server), the successful transmission of periodical traffic outweighs random traffic. This may because of the timeout configuration in the SECOD algorithm. Thus, we decided to tune some of the parameters of SECOD in order to improve our algorithm as explained in the following. Improvements of SECOD for SDN-Based IoT Networks  
To explain the improvement of detection time in the SECOD modified (SECOM), we set the same threshold value to 100 requests per port per monitoring period in the SECOD and per IP address in the SECOM, because if this value is set too small, it is so hard to catch the detection time in the SECOM. Meanwhile, as SECOD makes a decision using  
Figure 11: Performance of SDN-based IoT network under DDoS attack conditions with SECOD activated to detect and resist DDoS attacks. Figure 10: The Receiver Operating Characteristic (ROC) curve of SECOD. switch threshold, we set the switch threshold to 500 requests per switch per monitoring period so that the attacker could trigger the alarm after SECOD dynamically adjust the threshold per port. Then, we launch IoT Attacker-1 and -2 in Figure 5 and set the interval of malicious packets transmission to 1 ms (normally have 60 Packet_In message requests per second due to the hardware performance limit of Zodaic-FX switch). With 10 rounds test, we illustrate the result in Figure 12.  
By default, the monitoring period of SECOD is 10 s, while SECOM only needs to check the time duration when the counter of Packet_In requests hit 500. The average detection time of SECOD is 33.58 s, while SECOM only needs 1.65 s. In Table 5, we compare the detection time of SECOD and SECOM with some existing solutions against DDoS attacks in SDN-based IoT networks.