###### Abstract  
The article proposes an approach to ensuring the functioning of Software-Defined Networks (SDN) in cyber attack conditions based on the analytical modeling of cyber attacks using the method of topological transformation of stochastic networks. Unlike other well-known approaches, the proposed approach combines the SDN resilience assessment based on analytical modeling and the SDN state monitoring based on a neural network. The mathematical foundations of this assessment are considered, which make it possible to calculate the resilience indicators of SDN using analytical expressions. As the main indicator, it is proposed to use the correct operation coefficient for the resilience of SDN. The approach under consideration involves the development of verbal models of cyber attacks, followed by the construction of their analytical models. In order to build analytical models of cyber attacks, the method of topological transformation of stochastic networks (TTSN) is used. To obtain initial data in the simulation, the SDN simulation bench was justified and deployed in the EVE-NG (Emulated Virtual Environment Next Generation) virtual environment. The result of the simulation is the time distribution function and the average time for the cyber attack implementation. These results are then used to evaluate the SDN resilience indicators, which are found by using the Markov processes theory. In order to ensure the resilience of the SDN functioning, the article substantiates an algorithm for monitoring the state of controllers and their automatic restructuring, built on the basis of a neural network. When one is choosing a neural network, a comparative evaluation of the convolutional neural network and the LSTM neural network is carried out. The experimental results of analytical modeling and simulation are presented and their comparative evaluation is carried out, which showed that the proposed approach has a sufficiently high accuracy, completeness of the obtained solutions and it took a short time to obtain the result. c SF 2023 20  
In addition, SDN technology, in the near future, will introduce aspects of the open code for the network component of the cloud infrastructure, which is considered to be the most favorable basis for the development and implementation of a wide range of applications. It is based on the implementation of network devices and their functions on any network host using the OpenVswitch software switch. This approach allows one to use almost any computing device in the network as a switch/router. Another important feature of SDN technology is centralized controller-based network management, implemented using the OpenFlow management protocol and allowing users to not only to manage network devices, but also collect network statistics, which allows one to more effectively solve emerging problems in the network by reconfiguring all the network devices at the same time. The OpenFlow control protocol offers a number of attributes that are particularly well suited to implement a highly reliable and manageable environment:  
* The flow paradigm is ideal for security because it offers an end-to-end, service-oriented approach that is not bound by traditional routing constraints;
* Logically centralized management allows one to effectively control performance and threats throughout the network;
* Granular policy control can be based on application, maintenance, organization and geographic criteria rather than physical configuration;
* Resource-based security policies allow the consolidated management of multiple devices with different security risks, from highly secure firewalls and security devices to device access;
* Dynamic and flexible configuration of the security policy is provided by software control;
* Flexible traffic control provides the fast deterrence and isolation of intrusions without affecting other network users [2]. The conceptual structure of SDN includes the application layer, API, control layer, OpenFlow and data layer.