## 5 Proof of Concept
### AG Cuts  
We emulate the network topology shown in Figure 5 using Mininet ([[https://mininet.org/](https://mininet.org/)]([https://mininet.org/](https://mininet.org/)), accessed on 1 October 2023) with a single P4 switch. The data plane is described by P4 code compiled using the bmv2 behavioral model ([[https://github.com/p4](https://github.com/p4) lang/behavioral-model]([https://github.com/p4](https://github.com/p4) lang/behavioral-model), accessed on 1 October 2023), while the control plane is implemented as a custom controller we developed separately [21]. We abstract external hosts as a single traffic source connected to the P4 switch, which is also connected to three different subnets, each one  
Figure 4: The variation of the P4 NEntropy metric value during time in our tests: as it drops below the threshold of 0.5, the DDoS attack is detected and new rules are installed in the switch. Hence, the malicious traffic is blocked and the metric returns to its typical value. composed of six hosts with the role of destinations. Virtual links bandwidth is bounded by CPU capacity. We tested the topology on a Ubuntu 20.04 LTS Server with 14 GB of RAM and 3 CPU cores KVM machine. In our simulation, to produce the AG, we use the extended version [35] of the popular MulVAL application to make it compatible with our use case. The knowledge that [PERSON] uses to produce the graph is based on the assertion of some predicates that are written in the Datalog language [37]. We produced an input.P file that describes the topology of our network presented in Figure 5. To express the various fundamental network components such as hosts, gateways, active services, and known vulnerabilities, we employed the extended primitive rule set presented in [35]. The Datalog content of the input.P file is shown in Figure 6: for the sake of brevity, in the figure, we replaced long lists of similar lines with comments explaining what has been omitted. With this input, [PERSON] automatically generates the AG, trying to reach the goal written in the input.P file by verifying the predicates of his knowledge. Figure 7 shows the attack graph that is produced. Figure 5: Our use-case test topology, based on the one used in [8], with another subnet (10.0.10.0/24) protected by firewall. 1 /* attacker info */
2 attackerLocated(internet). 3 malicious(attacker). 4
5 /* network topology */
6 isGateway(switchP4,subnetP4). 7 isGateway(ovs1,subnet1). 8 isGateway(ovs2,subnet2). 9 isGateway(ovs3,subnet3). 10
11 located(ovs1, subnetP4, ipSubnet). 12 located(ovs2, subnetP4, ipSubnet). 13 located(ovs3, subnetP4, ipSubnet). 14
15 located(host1, subnet1, ipSubnet). 16 /* repeat for every host of subnet 1, 2 and 3 */
17
18 hacl(internet, host1, tcp, 80). 19 /* repeat for every host */
20
21 /* active services */
22 networkService(host1, ssh, tcp, 80, _). 23 /* repeat for every host */
24
25 acIH(host1, _, _, host1, tcp, 80). 26 /* repeat for every host of subnet 1 and 2 */
27
28
29 /* vulnerability information */
30 vuHostDos(host1). 31 /* repeat for every VULNERABLE host */
32
3 attackGoal(dos(attacker,host1)). Figure 6: The code of input.P, which is the input for MulVAL to generate the AG. Figure 7: The AG generated from the topology shown in Figure 5 that refers to just one host of the vulnerable subnets. The graph is repeated for every host that pertains to the vulnerable subnet. Based on the Datalog code that defines the relationships between elements of the network and attacks, the graph shows all the conditions that need to be verified to complete the hypothetical attack goal—in this case, a DoS attack. As a result, the vulnerable hosts are identified: they are the hosts that appear along a path in the AG; Figure 7 shows for the sake of clarity the AG for one host; the complete output would contain the AGs involving all hosts specified in the input file.