## 3 Methodology
### Algorithms Used for Optimal Controller Placement
```
1:\(distance(x_{1},x_{2})=d(x_{1},x_{2})\),
2:\(x1=\) a node present in the selected graph (say node 1), and
3:\(x2=\) another node present in the selected Graph (say node 2). Figure 1: Flowchart for optimal controller placement implementation. In Equation (1), latency is a function of _distance_, which is defined as how fast packets traverse between two nodes, and it is directly proportional to the physical distance separating these nodes. However, if the bandwidth between the nodes is increased, data transmission occurs at higher rates, resulting in reduced delay between consecutive packets, which is indicative of an inverse relationship. And, the Haversine distance formula from Equation (2) calculates the shortest distance between two points on a sphere:

\[dH(lat1,lat2,long1,long2)=2*radius*arcsin\left(\sqrt{\sin^{2}\left(\frac{lat2- lat1}{2}\right)+\cos\left(lat1\right)\cdot\cos\left(lat2\right)\sin^{2}\left( \frac{long2-long1}{2}\right)}\right) \tag{2}\]

where

\[ \begin{array}{l}Havesine\ distance(lat1,lat2,long1,long2)=dH(lat1,lat2, long1,long2),\\ lat2=\ \text{latitude of node 2},\\ long2=\ \text{longitude of node 2},\\ lat1=\ \text{latitude of node 1},\\ long1=\ \text{longitude of node 1},\\ radius=\ \text{radius of earth in kilometers}.\end{array} \]

From the topology, its graph \(G\) contains vertices \(V\) and edges \(E\), where \(V\) represents _Latitude_ and _Longitude_, and edges contains the _LinkLabel_ attribute denoting the bandwidth between any two vertices. The \(C\) term represents controllers. The \(L\) term represents the minimum within-cluster sum of squares (WCSS) loss value. Algorithm 1 shows the implementation of K-means++ and OPTICS to obtain an optimal controller placement. The workflow diagram of the designed system is shown in Figure 2. This diagram summarizes the entire workflow of network traffic (both benign and attack), providing a visual representation of how the multi-controller setup is organized to detect and mitigate DDoS attacks efficiently. The communication scheme between different components of the SDN environment, the host-switch, switch-controller, and controller-IDS is shown. A switch forwards the packets from a host to the respective interface using the flow table. Switches also advertise the flow information to their associated controller every 10 s. A controller does the job of managing the flow table of the switch and also performs feature extraction and pre-processing of the flow information, which will be sent further to the central IDS. IDS performs the task of classification of the traffic, benign/attack, and in case of an attack traffic, it broadcasts the attacker source information to each of the controllers. The controller with an attacker in its domain upon receiving this attacker information will activate the mitigation module and will request the installation of a flow in the respective switch to block the port of the attacker. The switch, upon receiving this request, will install this flow, and as a result, the attacker will be blocked for a predefined duration of 10 min. For normal traffic, no specific action is performed, and the traffic follows a normal natural route. A more detailed explanation on the detection and mitigation mechanism is provided in Section 3.9. ### Development of Network Topology

GML files for Aarnet and Savvis topologies were downloaded from the Internet Topology Zoo [34]. K-means++ and OPTICS algorithms were used to determine the optimal number and positions for controllers. Controllers were placed at the centroids of each cluster such that a controller controls switches (nodes) falling in that cluster. We implemented an outband control mechanism, meaning data and control packets travel through different channels in the network. Following this, each node was assigned as an OpenFlow switch with a designated number, aligning them with the controllers determined by the clustering results from the best between K-means++ and OPTICS.