## 6 Simulation and Results
### Detection Capability  
In order to justify that the detection of DDoS attacks is feasible through the use of the proposed methodology, a simulation was conducted. The simulation duration was split into 1000 continuous time slots through which agents calculate metrics and relay messages as discussed in Section 4. A network consisting of both multiple IoT devices and ordinary hosts was created. IoT devices are grouped into different installations and are monitored by different agents accordingly. Some of the IoT devices are supposed to be infected and used as part of a botnet. This botnet executes a DDoS attack against a specific victim host at a specific time interval of the simulation (starts at time slot 500 and ends at time slot 750). The normal traffic of the network along with the traffic triggered by the DDoS attack are simulated at each agent of the system, according to the model analyzed in Section 3. Then the methodology presented in Section 4 is employed, in order to detect the DDoS attack. The various simulation setups used have been designed by setting different values for the size of the network and the infection ratio (percentage of infected IoT devices). Specifically, nine different scenarios were studied according to the combinations of three different network sizes (5000, 7500 and 10,000 IoT devices) and three different infection ratios (1%, 3% and 5%). The hosts are equal in number to the IoT devices at each scenario, while the number of IoT devices at each installation (number of devices per agent) is approximately 10. Additionally, the generation probability of path-messages is set equal to 0.1. Finally, different values for factor \(c\) (maximum path-message length) were tested, in order to check which is the most efficient approach. The different values used for factor \(c\) were \(0.1,\ 0.2,\ 0.3,\ 0.4\), and 0.5. Tables 1-4 depict the results obtained through the different simulation scenarios. In Table 1 the average number of path-messages that exist in the network throughout the simulation is shown. The path-messages population significantly varies, for the different choices for the \(c\) parameter value. This metric is important as it is crucial to succeed in detecting the attack by using the minimum possible  
Additionally, in order to present the detection capabilities of the methodology an assessment metric is presented in Tables 2-4 for infection ratios 1%, 3%, and 5% respectively. Assessment metric used is the ratio of the highest observed \(T_{out}\) for the victim host over the highest observed \(T_{out}\) of all other hosts, throughout all path-messages processed. This assessment metric gives a good insight of the detection ability of the proposed methodology. The higher the assessment metric is, the easier it will be to detect the ongoing DDoS attack. This is only a general assessment metric and it is expected that the detection ratio values produced by Equation (9) for \(h_{v}\) will be even higher, as they are locally calculated for each path-message. By observing the results, it is obvious that it is feasible to detect the DDoS attack. Additionally, a common efficient value for \(c\) parameter for all cases is 0.3, as it generally gives quite satisfactory results. A shorter value choice would create shorter path-messages that would not collect information from the required number of agents, in order to detect the attack. On the other hand, larger values create longer path-messages, which seem to average out the information collected for the DDoS victim host. Figure 4 depicts the values collected by all path-messages constructed in the case of 5000 IoT devices network with a 3% infection ratio. These values have been gathered for a coefficient value \(c=0.3\). Records related to the actual DDoS victim host \(h_{v}\) are colored in red and can easily be identified from the rest of the records, which are colored in blue.