## 4 Experimental Results
### Implementation of a Neural Network for CA Detection  
To detect anomalies in SDN network traffic, a neural network architecture has been developed, which is based on LSTM cells (Figure 29). The neural network should return 1 if anomalies are detected in the network packet and 0 if there are no anomalies. In other words, the neural network solves the binary classification problem.  
LSTM neural networks have been chosen to avoid the problem of long-term dependency. The key components of the LSTM are the state cell and filters to protect and control the state of the cell. Filters let you skip information based on certain conditions. They consist of a sigmoidal neural network layer and a pointwise multiplication operation.  
Keras and TensorFlow libraries were used to write the classifier. Plots are built by the Matplotlib module. All calculations were made in the Jupiter Notebook integrated development environment. The neural network architecture consists of seven layers.  
The input layer takes three-dimensional tensors with a length of 179 characters as the input. The output layer of the classifier has only one neuron, which determines the probabilistic belonging of the data to the class of anomalies.  
The classifier is trained on pre-labeled data that includes both classes. The training lasted 200 epochs with the size of the portions (batch) of data being 128 sequences (lines) long. Figure 30 shows a graph of increasing accuracy and decreasing loss function in the process of neural network training.  
Figure 28: Flowchart of the server operation of the SDN resiliency system.  
To train the LSTM network, the Adam (Adaptive moment estimation) algorithm was chosen, which is considered as one of the most effective optimization algorithms used in training neural networks. This algorithm, unlike other well-known optimization algorithms, for example, the Root Mean Square Propagation (RMSProp) algorithm, adapts the parameter learning rate not based on the average of the first moment (mean), as in RMSProp, but on the basis of the average of the second moments of the gradients. This provides a high learning efficiency with low memory consumption. To train the LSTM model, 30 epochs were enough, with the step size at each iteration being equal to 0.001. Binary cross entropy was used as a loss function, which penalizes not only erroneous predictions, but also uncertain (noisy) predictions. In order to reduce errors of the first kind  
Figure 30: Graph of increasing accuracy and decreasing loss function in neural network training.  
Figure 29: Classifier tree structure.  
(i.e., False Positive), 10-fold cross-validation was used, the essence of which was as follows. The data set was randomly split into 10 parts. The model was trained on nine parts of the data, and the rest of the data were used for testing. In total, partition, training and testing were repeated 10 times.  
To assess the possible retraining of the model, a graph of accuracy and recall was created (Figure 31). The intersection of the accuracy and recall curves shows the optimum in anomaly detection in such a way that legitimate requests are not blocked.  
It can be seen from the figure that accuracy and recall tend to unity when the model is trained. This means that the number of anomaly detection errors tends to zero.  
The analysis showed that the proposed algorithm copes well to ensure SDN resilience by rearranging the operating modes of the controllers, while the threshold value can be adjusted to increase the detection accuracy.