# FEAROL: Aging Flow Entries Based on Local Staircase Randomized Response for Secure SDN Flow Tables
## 6 Evaluation
### Ferrol  
Since FEAROL is implemented in the flow-entry-aging process, which manages the lifespan of flow entries in the flow table, FEAROL does not directly affect the forwarding of flow packets. Therefore, FEAROL does not directly affect the overall forwarding latency of the network.  
To estimate how FEAROL affects the management of flow entries, we compared the the time cost of the aging process with staircase randomized response to that without staircase randomized response. Specifically, we wrote a simulation program using Python. We limited each flow table to a maximum of 10,000 flow entries. Each time a flow entry is aged, the simulation program checks whether or not the entry is out of its lifespan after updating the current existence time and the idle time of the entry to simulate how the aging process of the OVS works. We ran the simulation 100 times and recorded the total time cost of each run.  
We took the average total time cost and divided it by the number of the flow entries to obtain the time cost of aging a flow entry. We compared the time cost of aging a flow entry under Strategies 1 and 2 with the time cost without using a staircase randomized response. We used a laptop with Intel i7-8750H [EMAIL_ADDRESS] GHz and 16 G RAM to run the simulation. The results are shown in Figure 9.  
\begin{table}
\begin{tabular}{c c c c c c} \hline
**Type** & **Scenario5** & **Strategy1** & **Strategy2** & **Strategy3** & **Strategy8** \\ \hline
1 (normal) & 333 \(\pm\) 35 & 607 \(\pm\) 28 & 252 \(\pm\) 22 & 474 \(\pm\) 16 & 299 \(\pm\) 23 \\
1 (attack) & 560 \(\pm\) 0 & 494 \(\pm\) 28 & 0 \(\pm\) 0 & 519 \(\pm\) 17 & 0 \(\pm\) 0 \\ \hline
2 (normal) & 397 \(\pm\) 22 & 737 \(\pm\) 17 & 337 \(\pm\) 1 & 609 \(\pm\) 8 & 390 \(\pm\) 4 \\
2 (attack) & 213 \(\pm\) 4 & 276 \(\pm\) 16 & 0 \(\pm\) 0 & 370 \(\pm\) 17 & 1 \(\pm\) 0 \\ \hline
3 (normal) & 18,090 \(\pm\) 1098 & 27,504 \(\pm\) 720 & 14,440 \(\pm\) 877 & 27,881 \(\pm\) 985 & 16,680 \(\pm\) 1015 \\
3 (attack) & 18,530 \(\pm\) 0 & 17,045 \(\pm\) 1029 & 0 \(\pm\) 0 & 17,003 \(\pm\) 1058 & 7 \(\pm\) 0 \\ \hline
4 (normal) & 9793 \(\pm\) 23 & 11,982 \(\pm\) 573 & 7501 \(\pm\) 80 & 11,992 \(\pm\) 332 & 8921 \(\pm\) 29 \\
4 (attack) & 4790 \(\pm\) 0 & 3018 \(\pm\) 573 & 0 \(\pm\) 0 & 2976 \(\pm\) 348 & 1.5 \(\pm\) 0.28 \\ \hline \end{tabular}
\end{table}
Table 7: Confidential intervals of the flow table space usage for the traffic traces, 1—UNIV1, 2—SimpleWeb, 3—MAWI and 4—GUAT.  
It was apparent that the addition of FEAROL to the flow-entry-aging process increased the time cost of aging a flow entry. However, this increase was mainly contributed by the generation of the probability \(p\) to determine the aging action of each flow entry. When the probability \(p\) was given without randomization, as shown by the item strategy 2 without randomization in Figure 9, the time cost was reduced to the level without staircase randomization. This implies that we should optimize the random variable generation to reduce the time cost added by FEAROL. Although the time costs under strategies 1 and 2 are slightly different, this difference is too small and is most likely due to the overhead fluctuation of the laptop running the simulation program. A relationship between the time cost and the different strategies was not discovered.  
We believe that the overhead of FEAROL is an implementation problem. We can choose an efficient random number generation function, use a host with a faster CPU and larger RAM and reduce the frequency of the aging process being triggered to reduce the time overhead of FEAROL. To estimate how the update frequency affects the overhead, we let FEAROL be triggered every 10, 50 and 100 ms and compared these to the baseline where FEAROL is triggered every 1 ms. We found that the average time to update each entry remained the same. However, the overhead that FEAROL adds to the aging process was reduced, since the time interval for the update increases considering the timeout of each flow entry in practice.