## 2 Related Work
A number of works, for example [45; 46; 47; 48], are devoted to general issues of the quantitative assessment of the resilience of complex dynamic systems, which include SDN. They consider system resilience as its ability \"to plan and prepare for, absorb, respond to, and recover from disasters and adapt to new conditions [48]\". In addition, these works suggest an approach to assessing the computer network resilience based on taking into account the critical functionality and features of external influences on the network elements. Critical functionality can be defined as the quality of a system [48], as well as a metric of system performance, which is introduced to derive an integrated measure of resilience. For example, critical functionality can be calculated as the percentage of nodes that are functioning [46]. Among the works on modeling cyber attacks and countermeasures, the following papers should be noted, [49; 50], where discrete event modeling systems OPNET and COMNET, respectively, are considered. These systems use models of queuing networks, which assume that requests for service arrive according to a priori known distribution laws. However, these laws are not known in practice. In our approach, they are determined by the results of analytical modeling. Another example of an attack modeling and analysis system is the CAMIAC tool (Cyber Attack Modeling and Impact Assessment Component) [51]. It generates attack graphs, analyzes the consequences of the implementation of attacks and predicts future actions of the attacker. However, this tool does not allow one to obtain the functions of distribution of the attack time and does not allocate communication directions and routes in the network. This makes evaluating the cyber resilience of a network with CAMIAC extremely difficult. Thus, the following conclusions can be drawn from the related work analysis. First, stochastic analytical modeling and methods of the theory of Markov processes are of great importance for the development of countermeasures in modern cybersecurity systems. Secondly, stochastic models used to simulate attacks should be able to calculate the distribution functions of the random variables of interest to us (for example, the time of the attack and its individual stages) with minimal computational costs. Thirdly, stochastic models should provide high flexibility and be applicable for modeling attacks of any type. The approaches discussed above do not fully meet these requirements. The methods of the theory of Markov processes and the TTSN, which underlie the approach described below to assessing the SDN resilience, can eliminate this drawback. The TTSN method is based on the Graphical Evaluation and Review Technique (GETT) developed by [PERSON] [52]. GETT is a stochastic network project management method that has many advantages over traditional critical path methods and program evaluation and analysis methods. It combines circuit analysis, the probability theory, the simulation technique and the signal flow graph [53]. There are works in which GETTbased approaches are successfully used to assess the reliability of complex systems [54], to study high-tech product project plan dynamics [55], to process fuzzy data in research project management [56], to manage construction projects [57], to remanufacture process routing [58] and others. In our work, the GERT method was further developed due to the wider use in it of analytical expressions of probability theory related to the procedures of topological graph transformation.