## 3 RAD System
### Overview of RAD System Architecture  
This subsection provides an overview of our RAD system architecture, which is divided into three main modules with one storage, as shown in Figure 1. The three main modules consist of  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Type** & **Work** & **Goal** \\ \hline \multirow{3}{*}{\begin{tabular}{c} Traffic \\ Engineering \\ \end{tabular} } & Load balancing [3; 4; 5; 6] & Network efficiency \\ \cline{2-3}  & Rules/traffic optimization [7; 8; 9; 10; 11; 12; 13; 14; 15] & Efficiency of SDN controller or networks \\ \cline{2-3}  & Application-aware networking [16; 17] & QoS guarantee \\ \hline \multirow{3}{*}{\begin{tabular}{c} Measurement and \\ Monitoring \\ \end{tabular} } & New functionality provided to existing networks [30; 31; 32] & Efficient management with new features \\ \cline{2-3}  & Efficient measurement and monitoring [18; 19; 20; 21; 22] & High measurement accuracy and overhead reduction \\ \hline \multirow{3}{*}{\begin{tabular}{c} Security and \\ Dependability \\ \end{tabular} } & Reinforcement security of other networks [33; 34] & Improvement of security with programmability \\ \cline{2-3}  & SDN-specific security [23; 24; 25; 35; 36] & Securing against SDN network-specific \\ \cline{2-3}  & Policy-based approaches [37; 38; 39] & Access control at SDN controller \\ \hline \multirow{3}{*}{\begin{tabular}{c} Comprehensive \\ Monitoring and \\ Reactive System \\ \end{tabular} } & \
\begin{tabular}{c} Agile and robust response against abnormalities \\ (i.e., faults, elephant flows, and attacks) with efficient \\ \end{tabular} \\ \cline{1-1} \cline{2-3}  & Our proposed system, RAD &
\begin{tabular}{c} Agile and robust response against abnormalities \\ (i.e., faults, elephant flows, and attacks) with efficient \\ \end{tabular} \\ \cline{1-1} \cline{2-3}  & network performance \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of existing works.  
a _traffic analyzer_, _a traffic engineer_, and _a rule manager_. There is a _Data Storage for Topology/Anomaly Signature_. Furthermore, RAD utilizes the features of sFlow-RT and Snort IDS for flow classification and anomaly detection, respectively. The RAD system jointly operates with the SDN controller through a northbound interface obtaining traffic measurements and providing the new flow rules.  
In the _traffic analyzer_ module, sFlow-RT monitors traffic and collects and analyzes network statistics from network devices in order to classify both elephant and mice flows. In detecting elephant flows, the flow classification submodule triggers the traffic engineer to reactively generate an optimal routing path for these flows. As a proactive manner, the flow classification submodule periodically provides statistical information regarding flows for the traffic engineer to prepare paths for mice flows through the traffic engineer. Snort IDS also examines traffic to detect attacks based on rules generated, whereas the fault detection submodule monitors the status of devices in order to detect faults. If an attack or fault is detected, the traffic engineer is triggered to generate other optimal routes. The _traffic engineer_ calculates optimal routing paths with the aid of a cost function that utilizes current values of network utilization and delay. The load balancing submodule distributes normal traffic on multiple paths to increase performance and reliability. The _rule manager_ generates flow rules for network devices based on routing decisions from the traffic engineer, and pushes the rules to network devices through the SDN controller. _Data storage_ stores the information for network topology and signatures for the purpose of attack detection.