# Packet Injection Exploiting Attack and Mitigation in Software-Defined Networks
## 5 Evaluation
### Evaluation
It is because the controller needs to handle lots of _Packet-In_ requests, and its CPU processing power becomes less available. Since the PIEDefender can effectively detect attacks and install rules to drop malicious traffic without being forwarded to the controller, the controller CPU utilization remained normal before and after the attack under the protection of PIEDefender. At the same time, comparing the experimental results under different injection amounts, PIEDefender has a stable defense ability on controller CPU utilization. In summary, all results show that the PIEDefender can protect SDN controllers effectively. **Defense effect on OpenFlow switch:** We measure the number of flow table entries to evaluate the protection on the data plane with the PIEDefender. Figure 10a-d represent the flow table occupation under the injection of different numbers of hosts. As we can see, when the attack starts without the PIEDefender, the number of flow entries of the switch increases rapidly. It is because the controller does not validate the _Packet-In_ messages and installs rules for malicious packets. Since PIEDefender can quickly detect attacks and drop malicious traffic, the number of flow entries changes steadily without a surge. At the same time, comparing the experimental results under different injection amounts, PIEDefender has a stable defense ability on the switch flow table. In summary, all results indicate that the PIEDefender can effectively protect the data plane. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Algorithm** & **Precision** & **Recall** & **F1 Score** \\ \hline KNN & 94\% & 94\% & 94\% \\ SVM & 98\% & 98\% & 98\% \\ KMeans & 96\% & 96\% & 96\% \\ BayesNet & 95.92\% & 94\% & 94.95\% \\ DecisionTree & 96.08\% & 98\% & 97.03\% \\ RandomForest & 90\% & 90\% & 90\% \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Results of different detection algorithms. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Solution** & **Precision** & **Recall** & **F1 Score** \\ \hline Entropy-based & 93.88\% & 92\% & 92.93\% \\ Detpro & 97.92\% & 94\% & 95.92\% \\ DoSDefender & 95.92\% & 94\% & 94.95\% \\ PIEDefender & 97.96\% & 96\% & 96.97\% \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Results of different detection solutions. **Defence overhead**: We measured the CPU and memory resource consumption of PIEDefender with and without attacks to evaluate the defend overhead. The test time was the 60 s, and the attack started in 15 s.  
Figure (a)a depicts the change in CPU utilization. As we can see, with no attacks, the controller CPU utilization changes smoothly without significant fluctuations. It is mainly related to the implementation of the PIEDefender. On the one hand, the injection detection module uses the hashmap to manage mapping entries, and the complexity of the message verification function is \(O(1)\). On the other hand, we have pre-trained the attack detection model and no training process is required after deployment. With attacks, the discovery and detection of malicious hosts require a specific period. As a result, the CPU consumption increases gradually, peaking at 24%. After completing detection, the PIEDefender installs flow rules to discard malicious traffic. Thus, CPU consumption decreases and levels off. Figure 10: Comparison of switch ternary content addressable memory (TCAM) utilization with and without PIEDefender. (**a**) 50 hosts. (**b**) 100 hosts. (**c**) 150 hosts. (**d**) 200 hosts. Figure 9: Comparison of controller CPU utilization with and without PIEDefender. (**a**) 50 hosts. (**b**) 100 hosts. (**c**) 150 hosts. (**d**) 200 hosts. Figure 11b shows the shift in memory utilization. Since the verification function needs to store the mapping relationship between switches and hosts, it will bring some storage overhead. However this is minimal, especially when no attack occurs. There was an approximate 4% increase in memory utilization with attacks.