## 5 Experiments  
To further demonstrate the effectiveness of the proposed strategy, this section elaborates on the experimental verification of the connection partitioning strategy through several simulations. Algorithm 1 describes the standard process that our strategy follows. Particularly, the inputs that the algorithm requires comprise a configuration, the utilized splitting factor, and the threshold values for three stopping criteria defined in Section 3.2, as detailed in lines 4 to 12 of Algorithm 1. For all experiments, the configuration is structured as follows. We assume that the malicious connections follow a normal distribution across time. Moreover, for the sake of simplicity for all experiments, the peak of the malicious activity is located in the middle of the considered time slot. Additionally, we conducted experiments considering three distinct pollution factors, namely, 1%, 5%, and 10% of the total connections. Finally, we considered alternative sizes of connection pools, ranging from 1K to 10K, with increments of 1K. Each experiment was repeated 1000 times to extract the mean for all metrics. Without considering any stopping criteria, the simulation completes only when all the malicious nodes have been isolated, each to their own replica server, as indicated in lines 13 and 14 of Algorithm 1. Recall that the defender does not have any means of distinguishing between normal and benign connections; therefore, hosting a single connection in its own replica is important if it requires certainty regarding the nature of the connections. However, for reasons of completeness, we also conducted simulations considering the aforementioned three stopping criteria. Whether applying a stopping criterion or not, the simulation exits by returning the total elapsed time, the total connections saved, and the total nodes spawned, as shown in Algorithm 1. ```
Input: configuration, splitting_factor, max_time, min_connections_saved, max_number_of_nodes Output: total_elapsed_time, total_connections_saved, total_nodes_ spawned \(new\_configuration=configuration\)\(configuration\_health\_status=[]\)whiletruedo//Checkstoppingcriteriaandterminateifmet if\(total\_elapsed\_time>max\_time\)thenreturnreturn end ifif\(total\_connections\_saved>min\_connections\_saved\)thenreturnreturn end iflet(new_configuration)>max_number_of_nodesthen return return end ifCheckifallnodesofttheconfigurationcontainasingfunctionandterminateifmetif\(all\_nodes\_are\_size\_of\_one\)thenreturnreturn end if//Splittingphaseforeachnodeinnew_configurationdo\(new\_configuration.extend(split\_nodes(node,splitting\_factor))\)\(end\)\(total\_elapsed\_time+=SpawnTime+FreezeTime+RestoreTime\)//Evaluationphaseforeachnodeinnew_configurationdo\(configuration\_health\_status[node]=evaluateNodeHealthStatus(node)\)\(end\)\(total\_elapsed\_time+=EvalTime\)//Removehealthynodesforeachnode,statusinnew_configuration,configuration_health_statusdoif\(status==0\)then\(new\_configuration.remove(node)\)\(total\_connections\_saved+=len(node)\)\(end\)\(end\)\(total\_nodes\_spawned+=len(configuration)-len(new\_configuration)\)\(end\)
```  
**Algorithm 1**Split and Destroy  
Referring to Algorithm 1, through a while loop, all simulation strategies assessed here are comprised of several cycles of node _partitioning_ and _evaluating_ phases, referred to as _epochs_ in Section 3.2. Recall that, in the first phase, the replica nodes are spawned, followed by actions such as _freezing_ the state corresponding to each connection, _migrating_ the connection objects to newly spawned nodes through the network, and _restoring_ connections to the replicas, as described in lines 16 to 19 of Algorithm 1. In the second phase, the partitioning has been completed, allowing the assessment of the health status of each replica node, as shown in lines 20 to 29 Algorithm 1. Notably, the evaluation time depends on the particular application, setup, and attack. Nonetheless, we expect this time to be significant.