###### Abstract  
The main advantage of software defined networking (SDN) is that it allows intelligent control and management of networking though programmability in real time. It enables efficient utilization of network resources through traffic engineering, and offers potential attack defense methods when abnormalities arise. However, previous studies have only identified individual solutions for respective problems, instead of finding a more global solution in real time that is capable of addressing multiple situations in network status. To cover diverse network conditions, this paper presents a comprehensive reactive system for simultaneously monitoring failures, anomalies, and attacks for high availability and reliability. We design three main modules in the SDN controller for a robust and agile defense (RAD) system against network anomalies: a _traffic analyzer_, a _traffic engineer_, and a _rule manager_. RAD provides reactive flow rule generation to control traffic while detecting network failures, anomalies, high traffic volume (elephant flows), and attacks. The traffic analyzer identifies elephant flows, traffic anomalies, and attacks based on attack signatures and network monitoring. The traffic engineer module measures network utilization and delay in order to determine the best path for multi-dimensional routing and load balancing under any circumstances. Finally, the rule manager generates and installs a flow rule for the selected best path to control traffic. We implement the proposed RAD system based on Floodlight, an open source project for the SDN controller. We evaluate our system using simulation with and without the aforementioned RAD modules. Experimental results show that our approach is both practical and feasible, and can successfully augment an existing SDN controller in terms of agility, robustness, and efficiency, even in the face of link failures, attacks, and elephant flows. Keywords:software defined networks; network measurement; traffic engineering; intrusion detection system; network attacks; reactive routing +
Footnote †: journal: Applied Soft  
Recently, greater emphasis has been placed on preserving the availability of networks because of the importance of fault management for huge and complicated networks as well as the increasing numbers of distributed denial of service (DDoS) attacks. In particular, data center networks have a variety of requirements, including high availability of up to 99.999%, simple and quick error detection, reliability, and fast restoration [2]. Thus, enterprises demand a highly available SDN infrastructure to meet growing business needs. This type of infrastructure can be strategized by using an SDN controller. The controller provides a global and centralized view of the network. It transmits information between the network switches or routers and the applications above them. Having an abstract SDN controller enables us to control network elements programmatically and dynamically reconfigure these network elements based on network conditions. However, this shift of intelligence to the controller requires efficient operation therein. Leveraging the agility and programmability of SDN, the controller must provide comprehensive monitoring and management even when abnormalities are present and act as a nimble countermeasure to assure the availability. Many research groups have concentrated on utilizing the high controllability of SDN or preventing faults or anomalies, based on different goals: _traffic engineering_ for efficiency, _measurement and monitoring_ for accuracy and low load, and _security and dependability_ for specific attacks. Traffic engineering includes load balancing, flow rules and traffic optimization, and application-aware networking. Load balancing has been researched for network efficiency [3; 4; 5; 6]. The goal for flow rules and traffic optimization is SDN efficiency [7; 8; 9; 10; 11; 12; 13; 14; 15]. Application-aware networking guarantees quality of service (QoS) of multimedia traffic [16; 17].