# A Comprehensive Survey on Knowledge-Defined Networking
## 5 Control Plane
### Control Models
#### 5.3.3 Reactive vs. Proactive Control  
In the reactive control mechanism, network changes are triggered based on events or traffic patterns. Reactive control mode involves switches contacting the controller for decision-making, such as when the flow table does not have any entry for the flow/packet (arrival of a new flow), so the controller has to be consulted, where the controller will compute the path based on its policies and send the instructions for configuring the path for the flow table as a reaction to the request by the switches. Advantages of reactive control include that, as the configuration of the switches occurs only when needed, it will result in efficient use of network resources and reduced communication overhead. Reactive control supports dynamic network control such as adding or removing switches without requiring a network-wide configuration, and it can also adapt to changing traffic patterns in real time. When considering its disadvantages, one of the main concerns with reactive control is that it can provide a base for attackers to use trigger events to manipulate network behavior or cause denial of service attacks. Furthermore, it can act as a hindrance for the controller to obtain a global view of the network, as the controller only computes and installs flow rules in response to trigger events. In addition, it can also cause unnecessary delays for time-critical applications, as a trigger event is required for the controller to take an action. The Procera language has been introduced as a language that supports reactive control and includes a declarative policy language based on functional reactive programming [285]. A reactive approach for mitigating reconnaissance attacks using shadow servers is presented in [356]. A study that attempts to quantify the number of control plane messagesexchanged between an ONOS controller and data plane elements has found that reactive control results in a lower number of message exchanges, such that it addresses the scalability issue of KDN [357]. A study that analyzes the traffic traces involved in the reactive flow table update mechanism of OpenFlow states that there is a trade-off between the size of the flow table and the rate of installation of a missing rule [358]. A security framework with a reactive approach that analyzes potential attacks and isolates attackers for an industrial network has been studied in [359]. A reactive, stateful firewall for KDN that filters TCP communication according to network policies and processes the traffic into a set of OpenFlow rules with the help of a finite state machine of protocols has been studied [360]. A reactive control approach for mitigating security attacks such as port scanning, flooding, ARP spoofing, etc. using exception control packets has been studied in [361]. The study in [362] highlights that DDoS attacks can occur due to the reactive approach to flow rule installation in KDN and analyzes a set of strategies to overcome the vulnerability. In proactive control, the network controller pre-programs the forwarding elements with a set of rules to handle all possible traffic flows before the traffic arrives at the switches. In this approach, traffic is analyzed using different techniques, such as machine learning or algorithms, and control is provided before problems occur. Advantages of proactive control include that network downtime can be reduced by taking proactive measures to maintain network availability. Security can be improved by proactively implementing security policies before threats enter and spread through the network. In a proactive approach, the overall quality of service can improve, such as with less latency and high throughput, as network switches are programmed in advance. Disadvantages of proactive control include that it has limited flexibility, as it does not dynamically adjust to changes in network traffic. It also results in a high communication overhead, and the system becomes complex when the network is large, thus having low scalability.