## 5 DDoS Attacks Emulation on SDN-Based IoT Architecture
### SECOD Operations  
SECOD uses statistics of Packet_In messages within a predefined duration to decide if the control or data plane is suffering from DoS attacks. Thresholds on the switch and controller are predefined manually according to the network requirement and can be adjusted according to the real-time network operations. The definition of monitoring duration relies on the allocated system resource. That is, if administrator assigns more resources to monitoring and detection, the duration can be set to a small period to make early detection, though at the cost of consuming more resources. Alternatively, the detection time can be made longer, thereby saving resources, though there is a sacrifice. Once the attacker is localised, its incoming packets will be dropped based on its IP address. SECOD mainly operates based on the traffic behaviour according to the following principles. * _In order to stop the malicious packets_, SECOD blocks suspicious requests at the first node, which is the ingress port of SDN. A filter based on the IP address tries to find the source of attack and drop its packets once received on the ingress SDN switch. The reason that we choose IP address instead of MAC address as the metric is because the MAC address of a packet will always be the MAC address of the port that is directly connected to the SDN switch. However, the IP address could be the original address of the sender (or address of a network address translation router), so filtering by IP will allow a lower rate of false positives. Note that if the attacker is able to modify source IP address, then SECOD will have to block the whole port of SDN switch, because if these malicious packets already impact on the normal users attached to the same SDN switch port, it can hardly figure out where is the source of attack if the hacker is sophisticated. * _For IoT traffic_, the time period of periodical traffic is normally predefined, such as smart grids. Even for random traffic, the behaviour is predictable within an acceptable range, such as healthcare, it would not be infinite demand as in the traditional network. Random traffic that triggered by the event could be burst requests due to emergency situation, but they shall still under control because of the limit of original application. This feature makes SDN-based IoT network more efficient in detecting DDoS attacks, because the threshold of detection can be set more precisely according to different applications. Moreover, IoT applications can easily reach the user to inform any event or change. This helps the server to send out an alert to the abnormal device to ask for the involvement of user to check if the device is still working properly. Otherwise, it is separated from the network as a result of infection. Based on the reason above, DDoS detection in the SDN-based IoT network has advantages in the early detection, because the definition of threshold can be strict by reason of limited options of IoT requests. In some applications, such as connected car, the active time is generally during daytime, which means the network could cut down relevant resources and reduce threshold as well. Thus, SECOD can be modified to better adapt to IoT network, especially in early detection, we decide to use counter based time measurement to determine DDoS attacks. We measure the duration of threshold excess to detect DDoS attacks, if the duration is long enough, it is normal traffic. However, if the duration is shorter than the predefined value, it is regarded as under a DDoS attack. The predefined value depends on the service requirement and network performance. To compare the detection time in SECOD with SECOD Modified (SECOM), we define that the monitoring period is \(t\) seconds, attack rate is \(r\) packets/second, threshold is \(h\) packets/monitoring period, attack begins at the \(s\)th second (\(s<\ t\)) of the monitoring period and detection time period is \(d\) seconds. Then, the detection time in SECOD is  
\[\left\{ \begin{array}{ll}d=t-s,&r*(t-s)\geq h,\\ d=2t-s,&r*(t-s)<h,\end{array}