# An Adaptive Security Framework for Internet of Things Networks Leveraging SDN and Machine Learning
## 5 Enhanced SCAFFOLD Protocol
### Mathematical Model  
The Enhanced SCAFFOLD procedure is formally modeled using mathematical terminology and structures. The sets represent the fundamental components of a network, including switches, nodes, keys, and flows. Functions denote operations like encryption, feature extraction, and classification. The mathematical representations concisely capture the properties and relationships. For example, session keys are defined as pseudo-random functions of nonces and node keys. Encryption and decryption are modeled by applying keys to plaintext or ciphertext. Feature extraction and ensemble classification transform the traffic flows into predicted labels. This formalization complements the protocol definition by abstracting the implementation details into concise mathematical expressions. The model facilitates a rigorous analysis of protocol security and performance. Properties can be proven mathematically and understood through set relations. By bridging the natural language definitions to mathematical foundations, the modeling enables formal reasoning about protocol behavior. Extensions and modifications to the protocol can be represented and validated within the mathematical framework. The mathematical model provides a tool for precision in the specification, analysis, and evolution of the Enhanced SCAFFOLD protocol.  
We can further formalize SCAFFOLD mathematically. Let:  
* F = {f1, f2,..., fN} = Set of network flows;
* N = {n1, n2,..., nN} = Set of IoT nodes;
* K = {K1, K2,..., KN} = Set of symmetric keys derived from secret seeds;
* S = {s1, s2,..., sM} = Set of SDN switches;
* A = {a1, a2,..., aP} = Set of possible attacks;
* Set of public keys;
* Set of private keys;
PKi--Public key of node ni;  
Ski--Private key of node ni;  
Ki--Symmetric key of node ni;  
Kij--Shared symmetric key between nodes ni and nj;  
E(m,k)--Encrypt message m with key k;  
KDF--Key derivation function;  
SKij--Session key for the channel between ni and nj;  
P--Plaintext packet;  
C--Ciphertext packet;  
AES256--AES-256 encryption algorithm;  
D(c,k)--Decrypt ciphertext c with key k.  
**Preliminary Key Exchange**  
Node ni generates an asymmetric key pair (PKi, SKi).  
To establish the initial shared key Kij with nj;  
nj \(\rightarrow\) ni: E(PKj, PKi) using ni's public key;  
Kij = PRFK(PKj \(\mid\) | SKi), where PRFK is a pseudo-random function.  
**Secure Channel Creation**  
ni generates a 128-bit nonce Nni = IDi \(\mid\) | Rudi, where Rudi is a random value.  
Session key derivation:  
SKij = PRFK(Nni \(\mid\) | Kj).  
**Traffic Encryption**  
Encrypted traffic between ni and nj:  
Cij = AES256(Pi,j, SKij);  
where Pi,j is the plaintext traffic and Ci,j is the ciphertext. The key is renewed every 60 s.  
**Attack Detection**  
For a flow fk:  
Feature extraction: \(\varphi\)(fk) \(\rightarrow\) Fk;  
Ensemble classification: E(Fk) \(\rightarrow\) yk.  
where  
\(\varphi\) = Feature extraction function;  
Fk = Extracted feature vector;  
E = Ensemble of classifiers (RNN, RF, SVM);  
yk = Predicted label (\"Normal\" or \"Attack\");  
If yk == \"Attack\", an alarm is triggered.  
**Attack Mitigation**  
Identify correlated attack flows Fattack \(\subseteq\) F based on the analysis.  
The controller installs the SDN rules to block Fattack.