# FEAROL: Aging Flow Entries Based on Local Staircase Randomized Response for Secure SDN Flow Tables
## 6 Evaluation
### Staircase Randomized Response for Networks under LDoS Attacks  
We estimate the network performance when the flow table has a size limitation and the network is under LDoS attacks as described in scenarios 5 and 6. We let the network have a space limitation of about 1.2 times the flow table space usage in scenario 1. To enable flow table overflow LDoS attacks, we used the long attack flows with an attack period slightly less than 1 s, as the timeout of normal flow entries was set to idle at 1 s as described in scenario 1. We computed the number of attack flows to ensure that the packet rate of each network under attack was not greater than 1.2 times that of the network without attacks. We generated the attack flows, inserted the flows into the networks and computed the the maximum flow table space occupancy \(O\) and the total number of packets forwarded to controllers \(F\) for each data trace. The results are shown in Figure 7.  
It was apparent that the maximum flow table usage was not really affected by the staircase randomized response when under LDoS attacks. This is likely because the flow table usage that we computed is the maximum, which might happen when the LDoS attacks have only begun and the staircase randomized response needs more time to show its work.  
We then recorded the flow table space usage every 10 s. We tested all four data traces with all nine strategies. We plotted the results under strategies 1, 2, 3 and 8, as shown in Figure 8, for a better visualization. The hard and dotted lines in Figure 8 indicate the numbers of normal and attack flow entries in the flow table, respectively. We also conducted statistical analysis of the flow table space usage. Table 7 lists the 95% confidential intervals of the legitimate and attack flow table space usage over the four traffic traces.  
Figure 7: Applying staircase randomized response under LDoS attacks and with flow-table constraints.  
Figure 8: The real-time flow table usage under LDoS attack with flow-table constraints. The item normalflow(attackflow)-6-1 indicates the number of flow entries of the normal (attack) flows with strategy 1 involved in test scenario 6.  
It was apparent that applying the staircase randomized response in the flow-entry-aging process affected the flow table LDoS attacks. As the baseline, the number of flow entries for the normal and attack flows in scenario 5, as represented by normalflow-5 and attackflow-5 in Figure 8, had relatively small standard deviations as listed in Table 7. The number of flow entries in the flow table for normal flows varied under different strategies. When the network had flow entries that aged slower than normal, such as the strategies 1 and 3 with \(E(FA_{I})\) greater than 1 (the baseline), the number of flow entries for normal flows in the flow table was greater than the baseline.  
If the network had flow entries that age dfaster than normal, such as the strategies 2 and 8 with \(E(FA_{i})\) less than 1, then the number of flow entries for normal flows in the flow table was less than the baseline. However, the number of flow entries of attack flows was reduced regardless of which strategy was applied on the data traces. Specifically, applying strategies 2 and 8 reduced the number of attack flow entries to 0, indicating that the staircase randomized response mechanism mitigated the flow table overflow caused by LDoS attacks.