## 3 Methodology
### Algorithms Used for Optimal Controller Placement
To mitigate this issue, we implemented a multi-controller environment with controllers positioned strategically. In this setup, flow advertisements from switches are only transmitted to their respective controllers. Thus, no single controller is burdened by a substantial volume of advertisements from the data plane, providing some level of load distribution among controllers. Additionally, the use of the UDP protocol for decision packets ensured minimal congestion in the controllers. During a DDoS attack, the controller resources could be compromised, and utilizing TCP would lead to numerous retransmission packets, thereby delaying mitigation efforts. Consequently, UDP addresses this issue by encapsulating a compact packet without any retransmission overhead. Algorithm 2 shows that the IDS will always respond with a decision packet as long as the DDoS attack is on, implying that even if some UDP packets are lost, subsequent responses will cover this limitation without retransmission. These considerations ensure communication and coordination with minimum delay, allowing real-time threat detection and instant reply by controllers. ```
1:victim[ ] \(\leftarrow\) NULL
2:whileIDS is active do
3: Receive flow statistics from controllers every 10 s
4: Frame \(\leftarrow\) Extract_features()
5:forata \(\in\) Frame do
6: prediction \(\leftarrow\) XGB.Predict(data)
7:ifprediction=1 then
8: victim[data.dst_ip] \(\leftarrow\) (data.src_ip,count+1)
9:endif
10: Attack_source,Attack_destination \(\leftarrow\) GetMax_count(victim)
11: victim[Attack_destination].count \(\leftarrow\) 0
12: IDS.sendall(Cn, Attack_source)
13: Reset victim every 150 s
14:endfor
15:endwhile
```
**Algorithm 2** IDS Detection Algorithm. In Algorithm 2,

\(C_{n}=\) list of controller IP addresses,

\(Extract\_features()\) extracts relevant features from the flow statistics packet,

\(XGB\_Predict()\) classifies benign/attack using XGBoost, and\(GetMax\_count()\) returns the source IP of entry having the maximum count and exceeding the minimum threshold

Algorithm 2 describes the IDS detection process during a DDoS attack. An empty victim list is initialized in IDS. The IDS continuously monitors the flow statistics received from the controllers, which is updated every 10 s. The flow information originated from the Open flow switches, and it makes it up to the IDS via the respective controllers. The IDS extracts relevant features from the frame for analysis. Using XGBoost, each flow is classified as either a benign traffic (label 0) or an attack traffic (label 1). If an attack is detected, the attack count for the victim (using the destination IP) is increased. The function GetMax_count() finds the source IP that has attacked the victim the maximum number of times. At this point, the attacker IP to be blocked is well determined. Now, the victim count is reset, and IDS broadcasts the source IP to all the controllers. After every 150 s, the victim list is reset to free up memory and to prevent false positive for any legitimate traffic. However, once the IDS broadcasts the source IP, flagging it as an attacker, it will remain blocked for 10 min. ### DDoS Attack Detection and Mitigation in Emulated SDN Environment

A custom DDoS Python script with spoofed IPs using a Scapy library (v. 2.4.4) was launched from one of the hosts. This script differs from the one applied in dataset generation because the attack rate (up to 30 packets per second) varies in comparison to the hping3 attack rate (up to 56 packets per millisecond) utilized for generating the dataset. The rate was varied to assess the generalizing capability of the trained model. When a source host in an SDN generates attack traffic, this traffic is routed toward the victim host via intermediate switches. Every switch through which this attack packet goes reports the packet's flow statistics to its respective controllers.