## 2 Background
### SDN Security Issues
#### 2.3.4 Denial of Service in an SDN  
Denial of service (DoS) and distributed DoS (DDoS) attacks work by sending many requests for a certain period, congesting the system, and forcing it to slow down and decrease performance until it goes offline. The most affected aspects are the bandwidth, memory, and processing power. To consume all available bandwidth in a network so that normal traffic flow cannot be served and the service goes down, an attacker floods the network with malicious traffic at very high rates. In particular, an attacker may exploit vulnerabilities at the protocol level, such as TCP timeout retransmission [48], congestion control mechanisms [49], and the HTTP keep-alive mechanism [50]. Note that from the last report of Kaspersky (Q4 2020 DDoS attacks report [51]), we registered an increase in the number of DDoS attacks of around 10% compared with the same period in 2019. Even with the number of DDoS attacks is falling compared with Q3 2020, it is still a critical security issue to face.  
DoS and DDoS attacks in the context of SDN networks, in addition to conventional risks, can affect specific points of the SDN architecture, causing performance degradation of the whole network [52]. An attacker may create large amounts of malicious traffic with unknown or random protocol headers to trigger table-miss processes in the switch. If a switch does not find a match for such packets, it encapsulates and forwards them to the controller for further processing and decision making. This kind of attack can affect different components and characteristics of the SDN network. First, if an attacker creates a huge amount of malicious traffic, such as with fake headers, a switch has to forward each unknown packet to the controller. This may cause exhaustion of the bandwidth in the communication between switches and the SDN controller. Second, malicious traffic can consume all of a switch's capacity due to continuous table-miss processes in the switches. Finally, for the same reason, the controller may run out of resources and continue to process fake traffic for all packets sent from the switches to the controller.  
However, recently in the literature, several solutions have been proposed to face DoS and DDoS attacks in SDN-based networks. For instance, the work presented by [PERSON] et al. [53] proposed an interesting approach based on a mathematical model that identifies compromised hosts. Another interesting work in this field is that of [PERSON] and [PERSON] [54], which introduced an entire SDN framework based on machine learning algorithms capable of identifying and defending DDoS attacks. Finally, as described in [55], many other works have been proposed to challenge DDoS attacks in SDN-based networks. Some of them use machine learning approaches, while others use information theory approaches, always with the same goal of detecting and mitigating DDoS attacks in an efficient way. Even if this work does not propose approaches to mitigate and detect DDoS attacks, it will be different from the other works in the literature because it investigates the consequences that cyber-attacks may cause in industrial networks. To ensure this, we propose an SDN-based network for IT/OT convergence that is based on a real scenario (see SIRDAM4.0 support infrastructure [11]), and we study its behavior under cyber-attacks.