## 3 An Approach to Ensuring the SDN Resilience
### Examples of CA Reference Models
#### 3.2.2 Model of the \"Substitution of Network Topology\" Attack against SDN
The result of the \"Substitution of network topology\" cyber attack is the work of an attacker impersonating a trusted network device using identification data obtained by technical computer intelligence. Let us represent the CA implementation process described above as a stochastic network (Figure 5). Each node of this network is denoted by a diamond and corresponds to the CA stage presented in Table 7. Transitions between nodes occur with the probabilities indicated in Table 7 [13]. To determine the equivalent function, the concept of a closed stochastic network is introduced, as well as loops of the first and \(k\)-th orders [10; 11; 12]. The equivalent function of the \(k\)-th order loop is defined as  
\[Q_{k}(s)=\prod_{i=1}^{k}Q_{i}(s), \tag{5}\]  
where \(Q_{i}(s)\) is the equivalent function of the \(i\)-th loop of the first order, defined as the product of the equivalent functions of the branches included in this loop. Let us transform the original stochastic network into a closed one (Figure 6). This allows us to use the topological [PERSON]'s equation [60] for closed graphs to determine the equivalent function of the original network  
\[H=1+\sum_{k=1}^{K}(-1)^{k}Q_{k}(s)=0, \tag{6}\]  
where \(K\) is the maximum order of loops included in the stochastic network. After the stochastic network is closed by a fictitious branch, \(Q_{a}(s)=1/h(s)h(s)\) is the desired equivalent function, and we define all the loops. Loops of the first order:  
\[w(s)\cdot m(s)\cdot l(s)\cdot P_{\Pi\colon d}(s)/h(s);(1-P_{\Pi})\cdot z(s) \cdot l(s). \tag{7}\] \begin{table}
\begin{tabular}{c l c} \hline \hline
**No.** & **Description of the CA stage** & **Stage Symbol** \\ \hline
1 & Checking the connection channel to the attacked network & \(w(s)\) \\ \hline
2 & Exchange with the network controller via the Open Flow control protocol; & \(m(s)\) \\  & passing off your device as a legitimate network device & \\ \hline
3 & Sending network statistics data to the controller via the control protocol; & \(l(s)\) \\  & checking the response of the controller & \\ \hline
4 & Creating a network topology by sending false network statistics & \(z(s)\) \\ \hline
5 & Network management by tricking the network controller with false & \(d(s)\) \\  & messages from the Open Flow protocol & \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Scenario of a CA of the “Substitution of network topology” type. Figure 5: Stochastic network for the “Substitution of network topology” attack. Figure 6: Closed stochastic network for the “Substitution of network topology” attack. There are no loops of the second and higher orders. Then, Equation (7) can be written as  
\[1-w(s)\cdot m(s)\cdot l(s)\cdot P_{\Pi\cdot}d(s)/h(s)-(1-P_{\Pi\cdot})\cdot z(s) \cdot l(s)=0. \tag{8}\]  
The equivalent function in this case is  
\[h(s)=\frac{w(s)\cdot m(s)\cdot l(s)\cdot P_{\Pi\cdot}d(s)}{1-(1-P_{\Pi\cdot}) \cdot z(s)\cdot l(s)}. \tag{9}\]  
To determine the calculated ratio of the distribution function, we assume that  
\[\left\{ \begin{array}{l}W(t)=1-\exp[-wt];\\ M(t)=1-\exp[-mt];\\ L(t)=1-\exp[-lt];\\ D(t)=1-\exp[-dt];\\ Z(t)=1-\exp[-zt],\end{array} \right. \tag{10}\]  
where \(w=1/\bar{t}_{\text{mem}}\), \(m=1/\bar{t}_{\text{vac}}\), \(l=1/\bar{t}_{\text{tr}}\), \(d=1/\bar{t}_{\text{re}}\), \(z=1/\bar{t}_{\text{repl}}\), \(\bar{t}_{\text{mem}}\), \(\bar{t}_{\text{tac}}\), \(\bar{t}_{\text{tr}}\), \(\bar{t}_{\text{re}}\) and \(\bar{t}_{\text{repl}}\) is the average implementation time of the \(k\)-th CA process. Using the Laplace transform, we find images of the distribution density functions of the execution time of the \(k\)-th CA process:  
\[ \begin{array}{l}l(s)=\int_{0}^{\infty}\exp(-st)d[L(t)]=\frac{l}{l+s};\\ d(s)=\int_{0}^{\infty}\exp(-st)d[D(t)]=\frac{d}{d+s};\\ z(s)=\int_{0}^{\infty}\exp(-st)d[Z(t)]=\frac{d}{2+s};\\ w(s)=\int_{0}^{\infty}\exp(-st)d[W(t)]=\frac{w}{w+s};\\ m(s)=\int_{0}^{\infty}\exp(-st)d[M(t)]=\frac{m}{m+s}.\end{array}