## 6 Proposed Methodology
To overcome these types of attacks, SPP uses a filtering algorithm to filter unwanted traffic in SDN. First, SPP monitors the total traffic in an SDN network. If unwanted traffic is found, for example, continuous ICMP flooding messages, filtering is executed to control the flow of ICMP requests in the network. Two different criteria were used to filter the ICMP packets: (i) If the number of ICMP packets exceeds 60, the filtering process applied for the check; (ii) if the size of the packet exceeds 78, the filtering process is applied as shown in the Algorithm 2. Two-way filtering is an ideal methodology for SDN. The following Figure 9 shows how the filtering process works in simulated SDN networks. In this experiment, both ICMP and IGMP packets were filtered by the SPP. There is no special condition check for the IGMP packets. \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline
**Controller ID** & **Connection Status** & **State** & **Datapath–ID** & **Port** & **IP Address** & **MAC Address** \\ \hline C\_ID\_001 & Connected & Active & 000a09c02d81800 & Port I & 172.16.23.142 & FC-4D-D4-49-87-4E \\ C\_ID\_001 & Connected & Active & 000a09c02d81800 & Port I & 172.16.3.201 & fc-4d-d4-3c-ac-79 \\ C\_ID\_001 & Connected & Active & 000a09c02d81800 & Port I & 172.16.5.109 & 78-a5-b5-b0-38-91 \\ C\_ID\_001 & Connected & Active & 000a09c02d81800 & Port I & 172.16.7.41 & fc-4d-d4-3b-34-b \\ C\_ID\_001 & Disconnected & No & 0000a44319261689e & Port II & 172.16.8.144 & 68-14-01-25-d5-17 \\ C\_ID\_001 & Connected & Active & 0x000a4319261869e & Port II & 172.16.8.153 & 04-d4-c4-7d-fe-1e \\ C\_ID\_001 & Connected & Active & 0x000a44319261869e & Port II & 172.16.9.38 & 48-e7-da-96-ac-e5 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: SPP Database. Figure 9: Filtering process of ICMP with a threshold value. The filtering algorithm is executed only if the switch receives the maximum threshold value (n), where n = 60. If the value is less than 60, the ICMP packets are allowed in the network. An ICMP attack continuously generates a large number of flows with a small number of packets over a short period. Therefore, based on flow analysis, it is possible to determine the severity of ICMP attacks. The following formula was used to compute the percentages:

Of the ICMP packet is much smaller than that of the Ethernet frame size in the network. When the ICMP packets are affected, their size increases. It is possible to determine the degree of attack in the end switch based on the percentage of small bytes in ICMP packets. \[FSB=\frac{\sum_{i}^{FlowSum}Flow_{i}\Big{(}\overline{PacketsBytes_{i}}<T_{PB} \Big{)}}{FlowSum} \tag{1}\]

Most of the ICMP flooding packets are invalid; thus, the corresponding flow rules issued by the SDN controller will not last for a long period before the timeout. The percentage of flow increased sharply over a short period. This can be determined using the following equation:

\[PFSD=\frac{\sum_{i}^{FlowSum}Flow_{i}(Duration_{i}<t)}{FlowSum} \tag{2}\]
```
1. In Each Time Slot t
2. For Each Switch (S1, S2,..., Sn), I do
3. For each ICMP request (IC_R) from host (IP) arriving at switch, do
4. IF the Host (IP) is in the SPSS Database SPSS Db, then
5. IF Host(IP) Equals (C_ID, S, DP_ID, PN, MAC)
6. Switch approves Request Grant (R_G) issues to Host(IP)
7. Else
8. IF (Host(IP) = Real IP Address) and IF (Threshold_val \(\leq\) 60), then
9. IF (Packet_Size \(\leq\) 78), then
10. Switch Execute ICMP_Request Grant (R_G) issues to Host(IP)
11. Update SPSS
12. Else
13. Drop the ICMP Request r from the Host(IP)
14. End if
15. End if
16. End for
17. End for
```

**Algorithm 2** Filtering process

## 7 Experimental Setup

The implementation was tested using Mininet simulator running on a virtual machine with Windows operating system. Hyper-V virtualization technology, which enables virtualized computer systems on the Windows platform, was used. Analytical modelling, measurement, and evaluation were identified as the three main approaches commonly used to evaluate communication network systems.