## 5 Evaluation
### Evaluation Metrics
#### 5.2.4 Cost  
The cost of these three DDoS detection approaches mainly includes two parts: the computing cost and the flow statistics collection cost. The former is caused by computing the variable P\({}_{1}\), P\({}_{2}\) and P\({}_{3}\) in the controller or in the switches. The latter is caused by collecting the flow statistics information from switches. Especially, the cost of the baseline approach is mainly caused by periodically polling the switches. The cost of the proposed approach is mainly caused by triggering the flow statistics messages from the switches. In terms of the two part costs, the flow statistics collection cost has a greater impact on the network than the computing cost. The reason is that the controller usually has sufficient computing capability, while the bandwidth resource is very limited in the network. Too much computing cost may bring little impact on the controller but too much flow statistics collection cost  
Figure 13: The change of three variables for the proposed approach when threshold =8 KB and T = 1 s.  
may seriously interfere with the normal network traffic. Therefore, the cost comparison here refers more to the comparison of the flow statistics collection cost.  
According to the monitoring data in Subsection 5.2.1, the costs of the three DDoS Detection approaches are shown in Table 3. The cost of OverWatch is almost equal to zero because the computing and the polling are all carried out in the switches. The advantages on the flow statistics collection cost of the proposed approach are reflected in three aspects: (1) it pointedly chooses the targeted switches and the targeted flows through computing the variable P\({}_{1}\) in the controller; (2) it customizes the starting point of the collection by defining an appropriate flow statistics threshold; and (3) it combines the event triggering mechanism and customized collection algorithm to collect flow statistics information from the switches. As shown in Figures 9 and 10, the baseline approach collects the flow statistics information of all the flows from the very beginning. However, the proposed approach only collects flow statistics information for Flow Group 1 and Flow Group 2 from the eighteenth second. Under the condition of guaranteeing the detecting accuracy, the proposed approach generates less overhead than the baseline approach.  
However, in terms of the implementation complexity, OverWatch is much higher than the other two approaches. Considering the polling and the computing in OverWatch are accomplished in the switch, the implementation of OverWatch must modify the switch. Different from OverWatch, both the polling operation and the triggering operation can be accomplished by the related mechanism provided by openflow in the baseline approach and the proposed approach. In addition, to improve  
Figure 14: The change of three variables for the proposed approach when threshold =8 KB and T = 3 s.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Detection Approach** & **Flow Group 1** & **Flow Group 2** & **Flow Group 3** & **Implementation Complexity** \\ \hline baseline approach & 32 & 32 & 32 & low \\ OverWatch & 1 & 0 & 1 & high \\ the proposed approach & 8 & 7 & 0 & low \\ \hline \hline \end{tabular}
\end{table}
Table 3: The cost comparison of the three DDoS detection approaches.  
the accuracy of the proposed DDoS detection approach, the determined DDoS attack can be made by further identification through using the flow content analysis algorithms.