## 5 Conclusions  
In this study, we proposed a comprehensive monitoring and reactive defense system called RAD for use in defending various anomalies (e.g., internal faults, elephant flows, or outside attacks) on SDN networks. Such a comprehensive system has not been considered by previous studies on traffic engineering, monitoring, or attack defense systems. RAD offers hybrid proactive-reactive flow rule management with sFlow-RT to identify flow types, where mice flows follow a proactive flow mode and elephant flows are reactively routed according to the current network status. RAD uses Snort IDS to detect attacks. The traffic analyzer module in RAD first identifies elephant flows or detects attacks, the sends this information to the traffic engineer module. Cost function calculates each link cost based on the network utilization and delay of each link on the network. The multi-dimensional routing and load balancing module prepares new paths for the flows. The rule manager then generates the rules for new paths and pushes them to switches. We instantiated our RAD using Floodlight (an SDN controller) and Mininet (a simulation tool) to investigate the properties of the proposed system. We then conducted a series of simulation experiments for two cases with and without RAD. Our simulation results revealed that our approach is both practical and feasible, and can successfully augment an existing SDN controller in terms of agility, robustness, and efficiency. This is true even with respect to link failures, attacks, and elephant flows.  
To prove the feasibility of our goal in this paper, we have designed and developed a concrete RAD system with popular exterior tools (i.e., Snort IDS or sFlow-RT). Then, the current RAD is limited by features of the used tools. General IDSs (e.g., Snort IDS and Suricata [51] with a signature-based  
Figure 12: Ping completion time (Effect of mice flows).  
methodology and rule/policy driven security) operate based on traffic measurements and IDS rules, and perform misuse and anomaly detection, which is similar with Snort IDS. Moreover, sFlow-RT based on traffic measurements can be modified by other tools (e.g., NetFlow [52]) to classify the specific flows. Our current system does not solve all problems in SDN, but RAD can expand with other tools or methods [53; 54; 55] to support new features (e.g., detection against unknown anomalies). Provisioning interfaces to other tools for IDS and flow classification in RAD is a point for future study. Moreover, as further study, it will be valuable to evaluate our system with more complicated topologies, complex traffic generation and various attack scenarios, on SDN networks mixed with non-SDN switches. We will also enhance the cost function and evaluate the performances of our RAD system based on additional factors.  
This work was partially supported by NSF award CNS-1637371.  
This work is completed by [PERSON], [PERSON] and [PERSON]. [PERSON] focused on writing the paper with the traffic engineering algorithm. [PERSON] organized evaluations and analyzed the simulation results. [PERSON] developed and designed the proposed system in this work while helping to review this manuscript. [PERSON] guided this whole project as a corresponding author. [PERSON] helped us to implement and experiment our proposed system. We also thanked all of students who contributed to this work through their master projects during the academic year of 2015 and 2016 under [PERSON]'s directions.  
The authors declare no conflict of interest.