## 1 Introduction  
The Software Defined Network (SDN) has become one of the most prominent network architectures for efficient network management [1]. The two key features, the programability of the network and separation of control and data planes, enable flexible network configuration and efficient network monitoring and management. Although SDN has overcome the limitations of traditional networks, it has other varying problems caused by the centralized structural characteristics. SDN switches ask a controller how to handle an arrived packet if the packet does not match any of the predefined rules called flow tables. In response, the controller installs appropriate rules for them. In this protocol, a lot of unknown incoming traffic may incur a Denial of Service (DoS) attack at either the controller or the switches [2]. The controller can be overwhelmed by control packets for the unknown traffic, which may paralyze the entire network. On the other hand, the switches may suffer from the storage lack of the rules. SDN switches use TCAM (Ternary Content-Addressable Memory) as a storage for flow tables. Because TCAM is expensive and has high power consumption, the memory capacity of SDN switches is limited [3]. So, attackers can easily consume the flow tables with attack flows, which results in no space left for normal flows. Because of overflowed flow tables, incoming normal packets will be dropped, which leads to a DoS and performance degradation [4]. Since this flow overflow attack can be easily launched by an attacker with hosts in the target network, it should be considered a serious security threat. Therefore, this paper focuses on DoS at switches. Although various defense mechanisms have been proposed, they have limitations. Some research has proposed mechanisms for adjusting timeouts dynamically [5; 6; 7]. However, they need too much extra memory for caching or assign timeouts inefficiently. We will discuss the usage of timeouts in detail in Section 2.1. [PERSON], [PERSON], [PERSON], M proposed an architecture evicting flow rules in order of the flow's priority when a flow table is full, but they must collect statistics periodically [4; 8]. Meanwhile, a scheme to make table-miss flows detour a victim switch was suggested [9]. Still, it needs to install a large number of additional flow rules for the detour and further monitoring. To protect SDN switches from flow overflow attacks, we propose a dynamic timeout adjustment mechanism that determines both hard timeout and idle timeout based on historical statistics. The proposed scheme is inspired by a simple intuition, which is that a flow with more packets in the past is less suspicious or more trustable [10]. Under the intuition, a longer timeout is given to the flow. On the other hand, a flow with fewer packets is given a shorter timeout since it is more likely to be from an attacker. Since a long timeout avoids unnecessary control traffic between a controller and switches and a short timeout reduces the number of flows that unnecessarily occupy the flow table, the proposed scheme can prevent SDN switches from the flow table overflow attack without an additional control plane overhead. However, we encountered two problems to realize the intuition: how to maintain the historical statistics of each flow, and how to overcome control message increase for newly incoming normal traffic. Firstly, to manage the flow historic statistics efficiently, we develop a 2D counting bloom filter that stores the past statistics, i.e., the number of packets for each flow during a certain amount of time. It might be a network management overhead to maintain the statistics for several flows. The proposed 2D bloom filter can manage them efficiently. Each flow is hashed in two dimensions, respectively, by the source and by the destination, and the number of packets of the flow is recorded in the 2D indexed cell. Afterward, when a flow is incoming, the flow's statistics can be easily taken from the 2D counting bloom filter by the same hashing.