## 2 Related Work  
The economic paradigm of the modern world has led to the fact that developers of network equipment save on their costs, which in turn affects the overall resilience of information and telecommunication networks. This should not be forgotten when one is considering SDN technologies. Thus, SDN, on the one hand, creates a certain risk, opening up new opportunities for attackers [4; 5; 6; 16], and on the other hand, it provides new opportunities for creating alternative information security services. To date, there are three main directions for ensuring the SDN resilience in the context of targeted information technology impacts [17]. The first way is the optimization of the route used to reduce the technological cycle of controlling the central controller [18]. In [19; 20; 21; 22], variations in the improved Dijkstra algorithm based on the weighted graph model were considered. The error of the solution does not exceed 5-7% on average. The heuristic insertion method based on the \"nearest neighbor\" principle, as well as its offshoot, \"taboo search\", were considered in [23; 24]. However, despite the simplicity of the solution, these approaches are based on formally unfounded considerations, so it is difficult to prove that the heuristic algorithm for each set of initial data finds solutions that are optimal. The second \"structural\" approach to SDN resiliency is based on taking into account the characteristics of the network architecture. Often, an important factor is the resiliency of not the entire network, but its main part--the control system. Cyber attacks on SDN in 89% of cases are aimed at the control subsystem, since a failure in its operation leads to a general \"fall\" in its level of function. In [25], the structural SDN resilience is assessed through four main indicators: robustness, redundancy, resource management flexibility and speed. This assessment allows one to separate the routing process from data forwarding, which is essential for networks of this kind. A number of studies in the field of structural SDN resilience are aimed at redundant key controllers [26; 27; 28; 29; 30] with a large number of duplicated tributary channels and the use of alternative algebraic topologies (for example, \"Fat Tree\") [31], as well as hybrids [32; 33; 34; 35] of multilevel topologies, such as \"Star\" and \"Double Ring\", with the organization of protection of access channels according to the \"\(1+1\)\" principle. All the considered types of the organization of structural SDN resilience are characterized by common disadvantages:incompatibility of the virtual configuration with network controllers and the high cost of consistent hardware of the same type [36]. The third option for increasing the network resilience includes combined methods that combine the characteristic features of the first two options [37; 38; 39; 40; 41]. Unfortunately, the \"childhood illnesses\" of the low SDN resilience under CAs [42] have been ignored in combined approaches. In [43], a method similar to that proposed by us is considered for the preventive detection of the fact of impact on the central SDN controller, but unlike our approach, it is proposed to emulate the network protection system at the application level and use a complementary filter to eliminate anomalous requests to the control subsystem, which, as is known, has characteristic time delays during transient processes. In [44], it was proposed to use recursive learning to detect a CA on SDN. In this work, methods of approximation theory are used to reduce the time complexity. The proposed approach has demonstrated a high efficiency in detecting DDoS attacks due to the fact that it dramatically reduces the number of transfers over the network. The ideas presented in this work contributed to the fact that we chose the LSTM network, which is a type of recursive neural networks, to monitor the state of SDN.