## 3 An Approach to Ensuring the SDN Resilience
### Examples of CA Reference Models
#### 3.2.2 Model of the \"Substitution of Network Topology\" Attack against SDN  
To create a mathematical model of a CA of the \"Substitution of network topology\" type, let us imagine the scenario of its implementation in the form of a sequence of actions (Table 7). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Region** & **Objects** & **Problems** & **Existing Solutions** & **Disadvantages** \\ \hline \multirow{4}{*}{\begin{tabular}{c} External \\ level \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} Services. \\ Switches. \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} Thread table memory limit. \\ Vulnerability to synchronous attacks. \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} Intermediate safety \\ devices \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} Fails to integrate into a \\ virtualized environment \\ \end{tabular} } \\ \cline{3-3}  & & & & \\ \cline{3-3}  & & & & \\ \cline{3-3}  & & & & \\ \cline{3-3}  & & & & \\ \hline \multirow{4}{*}{\begin{tabular}{c} Inner level \\ applications. \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} Controller. \\ NBI/SBI \\ SDN \\ applications. \\ \end{tabular} } & \multirow{4}{*}{\begin{tabular}{c} One point of failure (controller compromise). \\ Network manipulation (controller interception). \\ Lack of authorization and authentication. \\ Lack of encryption. \\ Performance degradation. \\ Susceptible to spoofing attacks. \\ \end{tabular} } & \multirow{4}{*}{\
\begin{tabular}{c} Encrypted channel \\ \end{tabular} } & \multirow{4}{*}{
\begin{tabular}{c} Does not support all SDN \\ controllers and switches. \\ Does not encrypt all \\ transmission data. \\ \end{tabular} } \\ \cline{3-3}  & & & & \\ \cline{3-3}  & & & & Access Control List (ACL) \\ \hline \end{tabular}
\end{table} 
Table 6: Challenges in SDN architecture resilience. \begin{table}
\begin{tabular}{c c c} \hline \hline
**SDN Plane** & **Threat/Attack** & **Description** \\ \hline \multirow{4}{*}{1. Data} & 1.1. Flooding attacks & Switch flow tables contain only a limited number of flow rules \\ \cline{2-3}  & 1.2. “Man-in-the-middle” attacks & Active listening, in which the attacker establishes independent ties, because TLS is an add-on option, and it is not a standard \\ \cline{2-3}  & 1.3. Hacking/cashing of the controller & Since hacking the controller increases the risk to the data plane \\ \hline \multirow{4}{*}{2. Management} & \multirow{4}{*}{2.1. Service chain intervention} & This attack can lead to two consequences: (1) A malicious application can participate in the chain and delete the control message before other applications receive the necessary information; (2) A malicious application can become trapped in an endless loop to stop the chain execution of applications. \\ \cline{2-3}  & 2.2. Internal Storage Abuse & Using the internal memory of the controller \\ \cline{2-3}  & 2.3. Control Message Manipulation & Manipulation of control messages \\ \cline{2-3}  & 2.4. Northbound API Abuse & An SDN application can manipulate the behavior of other applications using a poorly designed Northbound API \\ \cline{2-3}  & 2.5. System Variable Manipulation & Manipulation of system variables \\ \cline{2-3}  & 2.6. Network Topology Poisoning & Changing the network topology \\ \cline{2-3}  & 2.7. DoS attacks & No significant authentication \\ \cline{2-3}  & 2.8. Unauthorized access to the controller & There are no valid user access rights \\ \cline{2-3}  & 2.9. Scalability and availability & Increasing the size and shear of the network creates problems \\ \hline \multirow{4}{*}{3. Applications} & 3.1. Lack of authentication/authorization & Applications do not use any means of authentication \\ \cline{2-3}  & 3.2. Inserting fraudulent flow rules & Connected malicious applications can insert false rules into flow tables \\ \cline{1-1} \cline{2-3}  & 3.3. Lack of access control & Difficult to implement access control \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Classification of attacks specific to SDN.