###### Abstract
\begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Processing Level**} & \multirow{2}{*}{**Where Does It Start**} & \multicolumn{2}{c}{**Performance Indicators**} & \multicolumn{2}{c}{**Types of Processes and Tasks**} \\ \hline \multirow{3}{*}{Control Plane} & \multirow{3}{*}{CPU of the controller} & \multirow{3}{*}{Thousands of packets per second} & Routing protocols (e.g., OSPF, IS-IS and BGP), Spanning Tree, SYSLOG, AAA (Authentication \\  & & & \\  & & & \\  & & & \\  & & & \\  & & & \\  & & & & \\ \hline \multirow{3}{*}{Data Plane} & \multirow{3}{*}{Dedicated hardware ASIC} & \multirow{3}{*}{Millions or billions of packets per second} & L2 and L3 switching (IPv4/IPv6), MPLS forwarding, VRF Forwarding, QoS Quality of Service) marking, Policing, Netflow collection and ACL (Access Control Lists)All of this allows us to highlight the main threat vectors for SDN:
* SDN network users receiving network services;
* Channel from user to network device;
* Network device Open Flow;
* Control and monitoring channel Open Flow;
* SDN controller. The controller, as a key component in managing the entire SDN infrastructure, is the most vulnerable element, an attack on which can lead to consequences that are critical for the entire infrastructure. When any network application is able to change the flow tables of any switch managed by this controller, the situation does not meet modern information security requirements. Different kinds of applications require different levels of access, and the more detailed the limitations of each application are (according to the nature of the task being performed), the more reliable the network will be. Thus, the possible results of CA impact on SDN are blocking the SDN controller and the Open Flow control and monitoring channel, introducing false information about an SDN network users receiving network services, violating the established rules for collecting, processing and transmitting information in SDN and failures in the operation of SDN, as well as compromising the transmitted or received information. This suggests that CAs and the ability to counteract their implementation are key factors that determine the resilience of SDN. For this reason, in the article, we focus our attention on CAs, as they are least studied topic, in our opinion, and also the most important group of destabilizing factors. Moreover, we will interpret the term SDN resilience as the ability of a data transmission network, in which the network control level is separated from data transmission devices and implemented in a software way, to implement its functions and processes under CAs. Despite the fact that quite a lot of works are devoted to the issues of ensuring the resilience of telecommunication networks and their protection against cyber attacks (their analysis is given in Section 2), the problem of ensuring the SDN resilience remains unresolved. This is largely due to the fact that the known solutions for ensuring the resilience and security of SDN do not take into account the specifics of the construction and operation of these networks. This predetermined the need to develop the approach proposed in this article. The approach under consideration involves the development of verbal models of CAs, and the construction of their analytical models. In order to build analytical models of CAs, the method of topological transformation of stochastic networks is used. To obtain initial data in the simulation, the SDN simulation bench was justified and deployed in the EVE-NG (Emulated Virtual Environment Next Generation) virtual environment ([[https://www.eve-ng.net/](https://www.eve-ng.net/)]([https://www.eve-ng.net/](https://www.eve-ng.net/)), London, UK, accessed on 15 January 2023). The result of the simulation is the time distribution function and the average time for CA implementation. These results are then used to evaluate the resilience indicators of SDN, which are found by using the methods of the theory of Markov processes [6].