# An Adaptive Security Framework for Internet of Things Networks Leveraging SDN and Machine Learning
## 6 Performance Analysis
### Attack Mitigation Delay  
The attack mitigation delay analysis showed that Enhanced SCAFFOLD could respond very quickly to contain obvious flooding-based DDoS attacks by identifying and blocking malicious traffic. However, more subtle attack types like reconnaissance probes, man-in-the-middle attacks, and malware infections posed greater challenges for rapid isolation by the system. The results indicate opportunities to further tune Enhanced SCAFFOLD's detection and mitigation components, especially to handle sophisticated threats that take advantage of protocol weaknesses rather than simply overloading targets. As new attack vectors continue to evolve, maintaining quick yet accurate response capabilities will remain critical for Enhanced SCAFFOLD to fulfill its mission of proactively defending IoT environments against emerging dangers. This evaluation establishes baselines to guide future performance enhancements. Table 11 provides vital performance metrics regarding the effectiveness of Enhanced SCAFFOLD's attack mitigation responses. The table summarizes the minimum, maximum, average, and median delays between detecting an attack and activating countermeasures through the SDN controller installing blocking rules. Four representative attack types were evaluated: distributed denial-of-service (DDoS), reconnaissance probes, man-in-the-middle (MITM), and malware infections [13]. For the DDoS attacks, the minimum mitigation delay was an excellent 26 ms, indicating that the attacks were contained almost instantly once detected. The maximum delay rose to 38 ms showing good consistency in the response times. DDoS attacks tend to have very overt traffic signatures, enabling prompt detection. The average mitigation delay was 31 ms and the median 29 ms, demonstrating Enhanced SCAFFOLD's ability to rapidly mitigate DDoS threats. However, lower-bandwidth DDoS attempts with more sporadic traffic patterns could pose greater challenges. Reconnaissance probes exhibited a higher minimum mitigation delay of 33 ms due to their potential subtlety compared to DDoS flooding. The more intermittent scanning behaviors make isolation more difficult, resulting in a maximum delay of 62 ms. The average and median delays were 47 ms and 44 ms, respectively, for the reconnaissance attacks. Further tuning of detection sensitivity for scanning patterns and reducing controller rule installation latency could improve mitigation performance. For the MITM attacks, the minimum mitigation time rose to 41 ms because of the complexity of distinguishing malformed packets. Isolating the attack flows requires accurately tracking the compromised sessions. The MITM response saw the highest maximum delay of 71 ms due to occasional misclassifications, undermining swift containment. The average and median delays were 53 ms and 52 ms, still representing reasonable mitigation speeds. Further cryptographic analysis and modeling of MITM artifacts [19] would enhance response. Malware infections showed a 39 ms minimum mitigation time, as abnormal behaviors triggered the security alerts. Persistent malware is harder to isolate completely, though, causing a maximum delay of 67 ms. The ensemble classifier took more time to assess potential malware and determine the correlated flows. The average and median delays were 49 ms and 48 ms, indicating decent but not ideal performances. Integration with anti-virus scanning and host signals, like suspicious process activity, could accelerate malware mitigation. Overall, Table 11 demonstrates Enhanced SCAFFOLD's ability to respond rapidly across a spectrum of attack types, though optimizable delays exist. The results highlight the exceptional speed against overt DDoS attacks versus increased challenges mitigating clandestine MITM and malware threats. This analysis provides crucial insights for boosting the mitigation capabilities, especially against sophisticated threats. Rapid yet precise attack containment will be critical as IoT environments face growing risks.