## 3 Methodology
### Algorithms Used for Optimal Controller Placement
There were fewer counts from the DDoS attack being sent to the victim, hence preventing the attack. Also, from Figure 21, it can be observed that CPU utilization increases significantly at the instance of DDoS attack (from time 12:51:00-12:51:30), and after the application of the mitigation module, it returns back to the normal state. Figure 19: Aarnet network with mitigation. Figure 17: Aarnet network without mitigation. Figure 18: Savvis network without mitigation. Figures 19-21 demonstrate that our model effectively detects and mitigates attacks in multi-controller environments. Additionally, normal service is re-established as soon as the attack is over. Figures 19 and 20 illustrate that aside from the largest/broadest spike, approximately from time 41 s to 59 s in Aarnet and from time 49 s to 58 s in Savvis, there is normal packet exchange. After the attack ends, the network continues with packet exchanges, as indicated by the smaller/thinner spikes that appear afterwards. This detection and mitigation address the limitations of previous models, which were either specific to certain topologies or focused solely on attack detection without considering network optimization. Furthermore, our algorithms showed strong generalization across both Aarnet and Savvis topologies; we used datasets generated from Savvis for testing in the Aarnet environment. This also confirms the robustness of our model. Our work mainly focused on end host-to-host attacks. For the cases of attack against a controller, the flow generated is treated similarly like an attack to a host, and it can be detected and mitigated using the same previous approach and algorithms. But in the case of IDS, a host cannot launch a DDoS attack directly against it, because in our setup, the IP address of the central IDS is not made accessible to the end hosts. ## 5 Conclusions

This study focused on optimized multi-controller placement and an efficient DDoS attack detection mitigation system. Our approach ensures rapid detection and mitigation with response time ranging from 0 to 10 s as the controllers are programmed to advertise the flows every 10 s. By emphasizing practicality and efficiency, we made use of real-life topologies consisting of multiple controllers and optimized controller placement, and we developed an algorithm for an independent unit of IDS featured with the best-performing

Figure 21: CPU utilization with mitigation. Figure 20: Savvis network with mitigation. ML model for DDoS detection. Additionally, we developed an attack mitigation algorithm with a resource-efficient robust defense system with minimal computational overhead on controllers. For achieving DDoS attack detection and near real-time mitigation, the flow table was advertised by each switch every 10 s to their respective controller. This information was further processed by the controllers and passed to the IDS via TCP. The IDS, on receiving this, predicts a binary classification using the XGBoost algorithm and broadcasts it back to all controllers. With this information, the appropriate controller activates its mitigation module and blocks the malicious hosts in near real-time duration. In this way, the proposed model used Kmeans++ and OPTICS to obtain an optimized controller placement for a topology with multiple controllers, and the developed system was able to both detect and perform a near real-time mitigation of DDoS attacks with an accuracy of 98.5%. Conceptualization, B.S., B.R.D. and S.R.J. ; methodology, B.S., B.R.D. and S.R.J. ; software, B.S. and B.R.D. ; experiment analysis, B.S., A.R. and M.K.Y. ; manuscript writing, B.S., B.R.D., A.R. and M.K.Y. ; validation B.S., B.R.D. and S.R.J. ; supervision, B.R.D. and S.R.J., writing--review and editing, B.S., B.R.D. and S.R.J. All authors have read and agreed to the published version of the manuscript. This research was supported by the University Grants Commission (UGC), Nepal (Grants ID: CRG-078/79-Engg-01) principally investigated by [PERSON]. The program code and dataset of this study shall be made available upon request.