## 3 Proposed SDN Simulation Framework
### Feature Space and Classification Model  
The proposed test framework has three major components: the network platform, the simulated IoT services, and the feature extraction and attack analysis. The network platform consists of both normal and malicious virtual machines, including a firewall. The simulated IoT services include certain IoT services that sense the data in the network. The Node-RED tool [24] is used to represent the flow model of MQTT. Node-RED is a flow-based visual programming tool built on NodeJS, which is commonly used in IoT system development. Developers have the freedom to use Node-RED in a variety of ways, and the same system can be constructed in a variety of methods. The BoT-IoT dataset [25] has been used to obtain the data features. The XGBoost methods were then used to analyze the feature vectors to differentiate between normal and abnormal cases. The packets are collected using the pcap utility to produce the required network flow. The extracted features from the network flow, as shown in Table 2, are stored in the database. The BoT-IoT dataset is a composition of normal traffic, probing attacks, DDoS and DoS attacks, and information theft, as shown in Figure 2. The normal traffic consists of legal network transactions. Virtual machine traffic flows are included in the data collection. The \begin{table}
\begin{tabular}{c c c} \hline \hline
**Sr. No.** & **Name** & **Description** \\ \hline
1. & seq &
\begin{tabular}{c} Sequence number assigned by the Argus \\ extractors \\ \end{tabular} \\
2. & stddev & Standard deviation \\
3. & min & The minimum timeframe for all instances \\
4. & mean & The average timeframe for all instances \\
5. & max & Maximum timeframe for all instances \\
6. & N\_IN\_Conn\_P\_DistP & No. of incoming connections/destination IP \\
7. & N\_IN\_Conn\_P\_SrcIP & No. of incoming connections/Source IP \\
8. & date & Packets/second destination to source \\
9. & State\_number & Numeric value for feature state \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Feature set used in the framework [26]. Figure 1: Proposed secure and intelligent SDN framework for smart cities. probing attack, also known as an information-gathering attack, is carried out by malicious individuals who use scanning or fingerprinting techniques to illegitimately obtain data from remote computers. Port scanning and OS fingerprinting are two forms of probing attacks found in the BoT-IoT dataset. In a DdoS attack, a malicious user overwhelms resources or services with invalid requests. Botnets, which are collections of hacked nodes on the network, are often used to carry out these attacks. The dataset includes HTTP, TCP, and UDP DdoS attacks. While attackers can use an information theft attack to gain access to sensitive or secret information, malevolent users may also use it. Data theft and keylogging are two types of information theft attacks in the dataset. The BoT-IoT data collection contains 9543 legitimate instances and 73,360,900 non-legitimate traffic flow instances. In this experiment, only 740,637 randomly selected examples were used. However, the retrieved instances include all forms of attacks, except for theft attacks, which have a negligible number in the BoT-IoT dataset. To validate the proposed model, a typical smart parking configuration was selected using ten simulated IoT devices. The Node-RED root is used to establish the connection between smart devices and Amazon Web Services (AWS) that generate normal traffic using the MQTT protocol. MQTT was created to connect devices in remote locations where there is not much network bandwidth or where a \"small code footprint\" is required. It is a good choice for wireless networks with varying levels of latency due to sometimes limited bandwidth or unreliable connections. MQTT started as an IBM-owned protocol that was used to communicate with SCADA systems in the Oil and Gas industry. It is now an open-source protocol that is run by the Organization for the Advancement of Structured Information Standards (OASIS).