Behavior Anomaly Detection in SDN Control Plane: A Case Study of Topology Discovery Attacks

Table 2

Variables and definitions of topology discovery and CTAD mechanism.

Variable	Definition
	th time slot of topology discovery
	Verification key for time slot
	Verification key extracted from the received LLDP packet
	th switch
	th switch ()
	th port of the th switch
	th port of the th switch ()
	Signal that informs the topology manager that the cycle of topology discovery has ended
	List of ports of the th switch
	List of ports of the th switch ()
	Link between the th port of th switch and the th port of th switch
	LLDP packet sent from the th port of the th switch
	Topology information of the entire SDN
	Number of LLDP packets received from
	List of
key_element	String containing number 0–9 and character A–F
	Dijkstra’s shortest path between the th switch and th switch
	Tag representing if bypass the LLDP flooding check
	RTT of at time slot
	List of all RTT records in last second(s)
	IQR of in the last second(s)
	The third quartile of in the last second(s)
send_rate	The rate of dynamic LLDP frame generator generating LLDP packets
	The traffic rate of
	The traffic rate of ()
	The list of traffic data of
	The list of traffic data of ()
	The correlation coefficient between and
	The execution time of function lldp_gen_random (, 𝑑𝑢𝑟𝑎𝑡𝑖𝑜𝑛)