# SDN-Based Secure Common Emergency Service for Railway and Road Co-Existence Scenarios
## 4 Implementation of the Proposed SDN-Based Service for Rail and Road Coexistence
### Security Improvement: DoS/DDoS Mitigation  
Some of the most famous DDoS attacks include the one on Google in 2017, which was the largest to date, and the one on AWS in 2020. GitHub also experienced a significant attack in 2018. In 2016, an attack on Dyn disrupted many major sites, and in 2013, an attack on Spamhaus slowed down the entire internet [36]. These attacks have led to a greater focus on improving network security. Figure 6: Emergency packet tagging and duplication. In the context of DDoS attack mitigation, blackholing and sinkholing are two commonly employed strategies. Blackholing is a technique that diverts all traffic towards a specific IP or IP range to a null route or 'black hole' during a DDoS attack. While this method effectively blocks malicious traffic from reaching its intended target, it may unintentionally impact legitimate traffic as well. Sinkholing, conversely, filters out malicious traffic while allowing legitimate traffic to pass through. It uses a decoy, or'sinkhole' IP address, to identify malicious nodes without disrupting traffic from legitimate sources. This method primarily targets IP addresses or domains associated with known threats. However, it may not be effective against new or previously unidentified malicious nodes. Moreover, establishing and maintaining a sinkhole infrastructure for traffic diversion and analysis can be resource-intensive. Sinkholing is often implemented at the DNS level, i.e., application layer. Despite their effectiveness, both techniques have certain limitations [37]. To address these challenges, a mechanism has been integrated into the developed SDN application, as depicted in Figure 7. This mechanism operates at the second layer of the OSI model, enabling early detection and blocking of malicious traffic. It functions in both proactive and reactive modes, as every emergency data packet is routed through the SDN controller. The application is designed to detect both new and previously unidentified malicious nodes. This approach ensures a more robust defense against DDoS threats. Figure 7: Flowchart: reducing DDoS attacks. This mechanism works by first differentiating emergency messages from common ones and extracting the IP and MAC addresses of the source node initiating the emergency message. The application then checks these addresses against those in the SDN application/database. If a match is found, the node is authenticated. Every emergency message is first sent to the SDN controller, which monitors the node's behavior. If any abnormal behavior is detected, such as changes in messaging behavior or attempts to send more messages than allowed, the node is marked as malicious, and all its data packets are dropped. If no abnormalities are detected, the emergency packet is forwarded to the ONOS controller, which then sends it to the primary emergency server. If the extracted IP and MAC are not found in the ONOS application/database, the node is marked as a new node and the node is considered new. The packet is first sent to the ONOS controller for observation and then forwarded to the secondary emergency server. In the meantime, the system continues to observe the node's messaging behavior for a certain period to monitor for any changes in behavior that might indicate malicious intent. If abnormal behavior is detected during the observation period, the node is classified as malicious and all the data packets to/from the new node are dropped and an alert is sent to the controller to block the node. If no abnormal behavior is observed during the observation period, the IP and MAC address of the new node are added to the ONOS application/database and the node is considered ethical and the data packet is processed normally. After adding the node's information into the ONOS application/database, the new node is served by the primary emergency server. This process ensures the continuous operation and security of the developed architecture, providing a robust defense for reducing potential DDoS attacks.