## 4 Results
### Case I: Network Performance Analysis for DDoS Attacks (24 Nodes)
#### 4.1.3 Step 3: Model Validation Phase  
Using Equation (13), the coverage rate of the attack path in the experimental case was calculated (Table 4). In Table 4, the first three columns were selected as possible attack paths for the experimental case, where the minimum support threshold was \(t=3\%\). Table 4 indicates that the MSPSO-IPTBK accuracy considering that the static traffic was 95.83% and that the error rate was 4.17% for the network topology (number of nodes = 32).  
**Scenario 2:** Dynamic routing cost of routes  
Considering the factors of traffic dynamics, including the bandwidth, traffic delay and QoS requirements, we set the different weights (i.e., cost) of each route in the network  
\begin{table}
\begin{tabular}{l c c} \hline \hline
**Attack Path** & \
\begin{tabular}{c} **Packets** \\ **Collected** \\ \end{tabular} &
\begin{tabular}{c} **Coverage** \\ **Percentage (\%)** \\ \end{tabular} \\ \hline \(n_{0}\)-switch1-router1-router5-router7-router2-switch2-n\({}_{11}\) & 500 & 41.67\% \\ \hline \(n_{0}\)-switch1-router1-router4-router7-router2-switch2-n\({}_{11}\) & 500 & 41.67\% \\ \hline \(n_{0}\)-switch1-router1-router3-router8-router2-switch2-n\({}_{11}\) & 170 & 14.17\% \\ \hline Total & 1200 & 100.0\% \\ \hline \hline \end{tabular}
\end{table}
Table 4: Possible paths of DDoS attacks (number of nodes = 32, array (\(x\), \(y\)), \(w=1\)).  
\begin{table}
\begin{tabular}{l c} \hline \hline \(n_{0}\)-Switch1-router1-router5-router4-router3-router8-router7-router10-router2-Switch2-n\({}_{11}\) \\ \hline \(n_{0}\)-Switch 1-router1-router5-router4-router3-router8-router7-router2-Switch2-n\({}_{11}\) \\ \hline \(n_{0}\)-Switch 1-router1-router5-router4-router3-router8-router2-Switch2-n\({}_{11}\) \\ \hline \(n_{0}\)-Switch 1-router1-router5-router4-router3-router8-router2-Switch2-n\({}_{11}\) \\ \hline \(n_{0}\)-Switch 1-router1-router9-router6-router8-router2-Switch2-n\({}_{11}\) \\ \hline \hline \end{tabular}
\end{table}
Table 3: Set of 118 possible routes between the attack node (\(n_{0}\)) and the victim (\(n_{11}\)).  
topology to decide the next hop path using the command res_cost = array ([\(x,y\)], \(w=x\)) for paths \(r1\)-\(r5\)-\(r7\)-\(r2\) and \(r1\)-\(r5\)-\(r10\)-\(r2\) (Figure 15).  
Using the A* search algorithm  
The same results were obtained as in the previous case.  
Using the MSPSO algorithm  
We used the MSPSO algorithm to analyse the possible attack paths for the test case (\(n_{0}\to n_{11}\)).  
The static and dynamic routing cases were examined as described in the following text.  
After 100 generations, three possible attack paths were identified for the static routing case (we set \(w=1\) for each path).  
Route 1: [\({}^{n_{0}}\),'sw1', 'r1', 'r5', 'r7', 'r2','sw2', '\(n_{11}\)']  
Route 2: [\({}^{n_{0}}\),'sw1', 'r1', 'r4', 'r7', 'r2','sw2', '\(n_{11}\)']  
Route 3: [\({}^{n_{0}}\),'sw1', 'r1', 'r3', 'r8', 'r2','sw2', '\(n_{11}\)']  
Similarly, four possible attack paths were identified for the dynamic routing case (\(w=x\)), where \(x\) represents a variable that depends on the bandwidth, QoS and traffic delay.  
Route 1: [\({}^{n_{0}}\),'sw1', 'r1', 'r5', 'r7', 'r2','sw2', '\(n_{11}\)']  
Route 2: [\({}^{n_{0}}\),'sw1', 'r1', 'r4', 'r7', 'r2','sw2', '\(n_{11}\)']  
Route 3: [\({}^{n_{0}}\),'sw1', 'r1', 'r3', 'r8', 'r2','sw2', '\(n_{11}\)']  
Route 4: [\({}^{n_{0}}\),'sw1', 'r1', 'r9', 'r3', 'r8', 'r2','sw2', '\(n_{11}\)']  
For the dynamic routing case (\(w=x\)), the coverage rates of the attack paths are listed in Table 5. Table 5 indicates that the accuracy of the MSPSO algorithm is 97.50%, and the false rate is 2.5% when the number of network topology nodes is 32. The experimental results of attack path reconstruction when considering traffic dynamics (i.e., \(w=x\)) are superior to those obtained when the effects of traffic dynamics were not considered (i.e., \(w=1\) for each path). Thus, the proposed MSPSO-IPTBK model is flexible for different routing applications.