## 3 An Approach to Ensuring the SDN Resilience
### Examples of CA Reference Models
#### 3.2.1. Verbal Model of CAs against SDN
\begin{table}
\begin{tabular}{p{113.8 pt} p{284.5 pt}} \hline \hline
**Stages of Impact Implementation** & **Basic Execution Methods** \\ \hline \multirow{6}{*}{Node identification} & Host identification is usually achieved by sending the ICMP ECHO\_REQUEST command using the ping utility. The ECHO\_REPLY response message indicates that the node is available. There are free programs that automate and speed up the process of identifying a large number of nodes in parallel, such as fping or mmap. The danger of this method is that ECHO\_REQUEST requests are not fixed by the standard means of the node. To do this, one need to use traffic analysis tools, firewalls or Intrusion Detection Systems (IDS). \\ \hline \multirow{6}{*}{Service identification or port scanning} & Identification of services, as a rule, is carried out by detecting open ports (port scanning). These ports are very often associated with services based on the TCP or UDP protocols. For example, open port 80 implies a web server; 25 th port—SMTP mail server; 31,337 th—server part of the Trojan horse Back Office; 12,345 th or 12,346 th—the server part of the NetBus Trojan horse. \\ \hline \multirow{6}{*}{Operating system identification} & The main mechanism for remote OS determination is the analysis of responses to requests, taking into account different implementations of the TCP/IP stack in various operating systems. Each OS implements the TCP/IP protocol stack in its own way, which makes it possible to determine which OS is installed on a remote host using special requests and responses.Another, less effective and extremely limited, way to identify OS nodes is to analyze the network services found in the previous step. For example, open port 139 allows one to conclude that the remote host is most likely running an OS of the Windows family. Various programs can be used to determine the OS. For example, mmap or queso. \\ \hline \multirow{6}{*}{Determining the role of a host} & The penultimate step at the stage of collecting information about the attacked host is to determine its role, for example, performing the functions of a firewall or a Web server. This step is performed on the basis of already collected information about active services, host names, network topology and so on. For example, an open port 80 may indicate the presence of a Web server, blocking an ICMP packet indicates a potential presence of a firewall, and the DNS host name proxy.domain.ru or fw.domain.ru is self-explanatory. \\ \hline \multirow{6}{*}{Identify host vulnerabilities} & The last step is to look for vulnerabilities. At this step, the attacker either manually determines the vulnerabilities that can be used to implement an attack or uses various automated tools. Shadow Security Scanner, nmap, Retina and others can be used as automated tools. \\ \hline \multirow{6}{*}{Implementation of the attack} & From this moment, an attempt to access the attacked node begins. In this case, access can be either direct, i.e., penetration into the host, or indirectly, for example, when implementing a denial-of-service (DoS) attack. The implementation of attacks in the case of direct access can also be divided into two stages: penetration and establishing control. \\ \hline \multirow{6}{*}{Targets of attacks} & It should be noted that the attacker at the second stage can pursue two goals. First, obtaining unauthorized access to the site itself and the information contained on it. Secondly, gaining unauthorized access to a node in order to carry out further attacks on other nodes. The first goal, as a rule, can be achieved only after the achievement of the second one. That is, first the attacker creates a base for themself for further attacks, and only after that can they penetrates to other nodes. This is necessary in order to hide or significantly complicate finding the source of the attack. \\ \hline \multirow{6}{*}{Completion of the attack} & The stage of completion of the attack is “covering up the tracks” on the part of the attacker. This is usually achieved by deleting relevant entries from the node’s logs and other actions that return the attacked system to its original, “pre-attacked” state. \\ \hline \hline \end{tabular}
\end{table}