## 3 Methodology
### Algorithms Used for Optimal Controller Placement
To identify the optimal number of clusters, the value for 'k' must be selected at the \"elbow\" point; this is the point where the distortion starts decreasing in a linear fashion [38]. For k = 2, two controllers, \(c_{0}\) and \(c_{1}\) were placed, yielding a WCSS loss of 0.1750, as shown in Figure 5.

Running OPTICS on Aarnet yielded a similar configuration as produced by K-means++ with two clusters and a WCSS loss of 0.2012. Hence, two controllers \(c_{0}\) and \(c_{1}\) were placed, as shown in Figure 6.

**Inference:** Since (WCSS loss of K-means++) \(<\) (WCSS loss of OPTICS), the result from K-means++ was implemented for Aarnet, yielding two clusters, as shown in Figures 6 and 7. Figure 7 is a more detailed diagram of the implementation of Aarnet topology. Figure 4: Elbow curve for Aarnet, optimal k = 2. Figure 5: Aarnet topology with K-means++. Figure 6: Aarnet topology with OPTICS. ### Algorithm Performance for Optimum Multi-Controller Placement in Savvis

Similarly, running K-means++ in Savvis resulted in an elbow at k = 3 with a loss of 2769.7302, as shown in Figure 8. Hence, controllers \(c_{0}\), \(c_{1}\), and \(c_{2}\) were placed accordingly, as shown in Figure 9. Again, running OPTICS on Savvis also yielded a configuration with three controllers, as depicted in Figure 10 with WCSS. Figure 8: Elbow curve for Savvis, optimal k = 3. Figure 7: System diagram of Aarnet topology (resulted from Kmeans++). Figure 5.0 System diagram of Savvis topology (resulted from OPTICS). Figure 5.1 Savvis topology with OPTICS. Figure 5.2 Savvis topology with K-means++. The WCSS in Savvis is relatively high compared to that of Aarnet. This difference can be attributed to the variation of link speeds in these networks. In Aarnet, the link speeds are typically in the order of gigabits per second (Gbps), whereas in Savvis, they range in the order of megabits per second (Mbps). This factor accounts for a larger denominator in Aarnet compared to Savvis in Equation (1), resulting in a smaller distance for Aarnet. After controller placement optimization, Figures 7 and 11 represent the resulting system diagram incorporating controllers, switches, and the central IDS along with the flow of actions. The arrows show the direction and type of packets flowing in the environment, whereas the lines represent the physical connections between the devices. Meanwhile, the system can detect and mitigate attacks appearing from multiple hosts simultaneously. For simplicity and clarity, we have illustrated an attack from only one host in Figures 7 and 11. DDoS is used despite there being a single host due to the host using multiple spoofed IPs for the attack. ### Performance Evaluation of ML Models

The computation time and accuracy are key factors that define the performance of an IDS. Therefore, the performance of ML models was assessed based on test time, which refers to the time taken to process the entire test set, as well as their accuracy, including precision, recall, and F1-score. From Table 2, it can be observed that random forest, XGBoost and LSTM offered greater than 95% test accuracy; this solves the detection part. However, to perform swift mitigation, a quicker response is equally important, and this faster response time has set XGBoost apart from others. The training accuracy of Naive Bayes was notably lower, as indicated in Figure 12, and a particularly low recall rate.. Consequently, we decided not to continue with Naive Bayes. On the other hand, KNN exhibited a relatively longer test duration (Figure 13) and a low recall rate. A lower recall rate for both Naive Bayes and KNN is shown in (Figure 14) for benign traffic. Figures 14 and 15 compare the similar performance of algorithms, random forest and XGBoost, based on test accuracy and test time. Although both algorithms exhibit identical precision for label 1 (DDoS traffic), XGBoost demonstrates a higher recall for DDoS attacks. This indicates that among all actual positive instances of DDoS attacks, XGBoost can predict a greater number of attacks successfully.