## 3 Methodology
### Algorithms Used for Optimal Controller Placement
The entire process of detection and performing mitigation takes a minimum of 0 s and a maximum of 10 s. We trained a model using a dataset from Savvis topology, and this trained model was used for the detection and mitigation of DDoS attacks in both Savvis and Aarnet networks to study the generalization of our algorithms. In Algorithm 3,

* \(C_{n}=\) list of controllers,
* \(C_{i}\).store() stores the received IP into memory,
* controller.load() loads stored IP from the memory,
* controller.erase() clears the memory,
* controller.block() creates flow entry to block the DDoS traffic. Algorithm 3 shows how a controller blocks an attacker. The ALERT_CONTROL function receives broadcasts from the IDS in an event of attack and stores the source IP in the controller. This algorithm is run in all of the controllers, so all of them store the attacker's IP. Now, the next function MITIGATION_MODULE becomes functional. An empty port_map dictionary is initialized which, will be used to store the datapath (the switch) and the in_port (the switch port where the packet entered). When a packet arrives (realized by the packet_in event), the controller extracts relevant details: namely, datapath (unique OpenFlow identifier assigned to a switch), switch_id (general name of a switch), src_ip (the source ip of the attacker), and in_port (the switch port where the attacking packets entered). Now, if the in_port is connected to a host (not to some other switch), then the port_map dictionary stores the value (datapath, in_port) to the source_ip key. The controllers retrieve the attacker IP (source_ip) and store it in the variable _attacker_. If any key in the port_map matches with _attacker_, it means that the attacking host lies in the controller's domain, and if there is no match, then the controller will remain idle, since the attacking host is not in their domain. For the controller containing the attacking host, a blocking rule to block DDoS traffic is created by a flow entry using the controller.block() module. Only the associated switch (identified from the datapath) installs this blocking flow in its flow table. As soon as this flow is installed, the attacking host becomes blocked. Meanwhile, the controller deletes old attack records from its memory using controller.erase(), ensuring its memory is not overloaded. After a period of 10 min (an arbitrary assumption), the port_map dictionary is cleared. This prevents some genuine traffic from being blocked indefinitely. However, if the attacker still continues to send DDoS traffic, it will again be flagged and blocked by the same mechanism. ```
1:Attacker IP Address, \(C_{n}\)
2:functionAlert_Controller:
3:for\(C_{i}\in C_{n}\)do
4:Source_ip \(\leftarrow\)\(C_{i}\).receive(IDS)
5:\(C_{i}\).store(source_ip)
6:endfor
7:return None
8:endfunction
9:functionMitigation_Module:
10:port_map[ ] \(\leftarrow\) NULL
11:Packet_In_Event
12:(datapath,switch_id,src_ip,in_port)\(\leftarrow\) Extract_features()
13:if_port is connected to a host then
14:port_map[source_ip] \(\leftarrow\) (datapath,in_port)
15:endif
16: attacker \(\leftarrow\) controller.load()
17:if attacker in port_map then
18:controller.block(port_map[attacker].datapath, port_map[attacker].in_port)
19:controller.erase()
20:endif
21:Reset port_map every 10 min
22:return None
23:endfunction
```

**Algorithm 3** Attack Mitigation Algorithm. ## 4 Results and Discussion

### Algorithm Performance for Optimum Multi-Controller Placement in Aarnet

For an unsupervised algorithm, determining the optimal number of clusters is a fundamental step. The elbow method identifies the optimal value of centroids (k) for the K-means++ algorithm. Similarly, we used grid search to determine the optimal value of centroids using OPTICS. We performed a continuous iteration for k = 1 to k = 10, and for every value of 'k', WCSS was calculated. It provides the sum of square distances between each location and the centroids. A graph of k versus their WCSS value is plotted in Figure 4, which resembles an elbow.