## 3 An Approach to Ensuring the SDN Resilience
### Examples of CA Reference Models
#### 3.2.3 Model of the \"Hacking/Crashing Controller\" Attack against SDN  
Let us now consider the process of successive CAs against the transmission plane. An SDN transmission plane is a collection of edge routers. Consider the CA in the case when the intruder aims to disrupt the information exchange between the local structures of the corporate network without knowing the features of its functioning. The CA process begins with sending packets of various protocols to the SDN router to determine the response of routers in time \(\overline{t}_{\text{re}}\) with the distribution function \(M(t)\). Based on the reaction of the network device to requests, the vulnerabilities are determined in time \(\overline{t}_{\text{sen}}\) with the distribution function \(B(t)\). Then, the decision-making system makes a decision to conduct the \"Heavy Packet\" CA in time \(\overline{t}_{\text{r}}\) with the function \(L(t)\). If the attack leads to disruption of the SDN operation and the probability of this event is equal to \(P_{n}\), then the attacker proceeds to eliminate CA traces in time \(\overline{t}_{\text{st}}\) with the distribution function \(N(t)\). With the inverse probability \(P_{\text{pr}}=1-P_{\text{p}}\), the protection tools will detect an attempt to carry out an attack and start the process of network reconfiguration. In this case, the attack process will start again from the moment the decision is made with the choice of the next attack of the universally unique identifier (UUID) flooding type (spam sending by the universal number of the attacked switch) in time \(\overline{t}_{\text{r2}}\) with the distribution function \(U(t)\). If the attack leads to disruption of the SDN, and the probability of this event is equal to \(P_{\text{p2}}\), then the attacker proceeds to eliminate the CA traces in time \(\overline{t}_{\text{st}}\) with the distribution function \(N(t)\). The probability that the protection tools will detect an attack attempt and start the network reconfiguration process is \(P_{\text{pr}}=1-P_{\text{p2}}\). In this case, the attack process will start again from the moment the decision is made, and the next attack of the \"Sending a large number of packets\" type will be chosen in time \(\overline{t}_{\text{r3}}\) with the distribution function \(G(t)\). If the attack leads to disruption of the SDN and the probability of this event is equal to \(P_{\text{n3}}\), then the attacker proceeds to eliminate traces of the SC in time \(\overline{t}_{\text{st}}\) with the distribution function \(N(t)\). The probability that the protection tools will detect an attack attempt and start the network reconfiguration process is \(P_{\text{pr}}=1-P_{\text{n3}}\). In this case, the system will start the attack process again from the moment the decision was made. The process of conducting the CA to the data transmission plane in the SDN described above can be represented as a stochastic network shown in Figure 7.  
To use the method of topological transformation and obtain an equivalent function that preserves in its structure the distribution parameters and the logic of interaction of elementary random processes [13; 14], we close the resulting stochastic network, while ensuring its closure (Figure 8). Using the Laplace transform [62], we define images of the density functions for the distribution of the execution time of the \(k\)-th CA process:  
\[ \begin{array}{l}l(s)=\int_{0}^{\infty}\exp(-st)d[L(t)]=\frac{l}{l+s};\\ b(s)=\int_{0}^{\infty}\exp(-st)d[B(t)]=\frac{b}{b+s};\\ u(s)=\int_{0}^{\infty}\exp(-st)d[U(t)]=\frac{1}{m+s};\\ g(s)=\int_{0}^{\infty}\exp(-st)d[G(t)]=\frac{b}{s+s};\\ n(s)=\int_{0}^{\infty}\exp(-st)d[N(t)]=\frac{m}{m+s};\\ m(s)=\int_{0}^{\infty}\exp(-st)d[M(t)]=\frac{m}{m+s}.\end{array}  \tag{17}\]  
By substituting the obtained expressions into the equivalent function of the stochastic network of the CAs against the SDN control plane and passing to the original space, we obtain:  
\[