Determine the scale behavior of flow installation and packet-in processing

Determine how BALLAST’s flow-rule installation rate and reconnaissance-related packet-in load behave at network topologies larger than the seven-host SWaT configuration.

Background

The paper analytically estimates that flow-rule work grows linearly with the number of network nodes and that reconnaissance throttling bounds packet-in traffic. However, these claims are derived from the fixed SWaT topology and are not supported by measurements on larger networks.

A topology-scaling experiment is needed to establish whether controller processing, flow-table behavior, and packet-in load remain within the stated deployment limits as the number of hosts and stages increases.

References

We have not measured either quantity at scale, and a topology sweep is the natural complement to the platform sweep reported here.

— BALLAST: Physics-Aware Moving Target Defense for Industrial Control Systems Using a Digital Twin Safety Oracle  (2610.18311 - Mogollon-Gutierrez et al., 13 Oct 2026) in Section 5.1, subsection “Computational Complexity”