## 5 Proof of Concept
### AG Cuts
As a consequence, to minimize the number of traffic flows, the network has to focus on calculating the flow entropy that is meaningful to minimize the load on the network control plane. In practice, without GRAPH4, the \(T_{c}\) value will be always proportional to \(N_{h}\). Instead, with GRAPH4, this number is tied to \(V\), which is by definition less than or equal to \(N_{h}\). Therefore, if the network contains fewer vulnerable hosts, i.e., some hosts are not affected by DDoS attacks as proven by the AG, \(T_{c}\) will be lower. In Figure 9, we summarize this concept: \(T_{c}\) will be linearly increasing with the number of hosts in the network \(N_{h}\) without  
Figure 8: Packet Processing Time (PPT) in the switch plotted for 10,000 packets with varying percentages of metrics calculation. The goal of the figure is to show that the single PPT of a packet is independent and not influenced by the number of packets subject to metric calculation. GRAPH4 (\(V=N_{h}\)). On the other hand, with GRAPH4, it will be upper bounded by the number of vulnerable hosts \(V\), which is why the curves in Figure 9 become constant when \(N_{h}=V\). To give further evidence of the linear relationship between \(T_{c}\) and \(N_{h}\), we performed a series of five tests, each of them with 50,000 packets forwarded, within the same experimental environment as the test shown in Figure 5.0 We sent different amounts of packets directed to vulnerable hosts that need to be monitored from the switch: in the first case, 0% of the packets were directed to the vulnerable hosts, then 12.5%, 25%, 50% and 100%, mirroring the conditions of the previous experiment. During these tests, the mean value and variance of PPT were measured. The obtained results are depicted in Figure 5.1 The observed linear trend confirms our previous assumption on the independence between PPTs of packets within flows that are monitored or not by the switch for metric computation, thus confirming the linearity hypothesis. Finally, we want to remark that the volume of additional data transferred between the control and data plane can be deemed negligible, since GRAPH4 only sends a small alert each time the entropy threshold is hit. In fact, an alert only contains the source and destination IP addresses of the flow hitting the entropy threshold, resulting in a minimal data payload of 64 bits per anomaly detection event. Compared with traditional SDN-based mirroring approaches, where all the traffic is sent to the control plane, GRAPH4 only sends an alert every time an anomaly is detected. For example, high-speed networks often treat the Tbps of traffic: mirroring this volume of traffic to the control plane can result in low detection responsiveness and high detection overhead. On the contrary, GRAPH4 aggregates the attack in a 64-bit alert, which allows prompt control plane decisions. Figure 5.2 The Computation Time (\(T_{c}\)), measured in time units, based on the formulas shown before. The blue case is when \(V=N_{h}\), and the function result is the same as without the use of AG. The other cases are with different values of \(V<N_{h}\), i.e., there is only a minor subset of vulnerable hosts in the network: in those cases, we can see the improvement in the calculation time, which is the benefit that the use of GRAPH4 provides, and this is labeled as \(\Delta_{i}\).