## 3 An Approach to Ensuring the SDN Resilience
### Basic Expressions for Evaluating SDN Resilience
Normalization condition: \[\sum_{i=0}^{4}p_{i}(t)=1\] (3)  
The moments of probabilistic transitions of SDN from state to state when using the protection strategy are uncertain, random and occur under the action of event flows, which are characterized by intensities \(\lambda_{ij}\) (see Table 3). Intensities are an important characteristic of event flows and represent the average number of events arriving per unit of time. The numerical values of the intensities \(\lambda\) will be set in accordance with the simulation model. When one is solving a system of linear differential equations with constant coefficients (homogeneous Markov process), we use continuous time \(t\rightarrow\infty\). According to the labeled state graph (see Figure 3), we compose the system of Kolmogorov differential equations with unknown functions \(p_{i}(t)\)[59]:  
\[D(P,T)=\left\{ \begin{array}{l}\frac{dp_{0}(t)}{dt}=\lambda_{51}p_{4}(t)+ \lambda_{31}p_{2}(t)-\lambda_{12}p_{0}(t),\\ \frac{dp_{1}(t)}{dt}=\lambda_{12}p_{0}(t)+\lambda_{32}p_{2}(t)-\lambda_{23}p_ {1}(t),\\ \frac{dp_{2}(t)}{dt}=\lambda_{23}p_{1}(t)+\lambda_{31}p_{0}(t)+\lambda_{35}p_ {4}(t)+\lambda_{34}p_{3}(t)-(\lambda_{23}+\lambda_{34})p_{2}(t),\\ \frac{dp_{3}(t)}{dt}=\lambda_{43}p_{2}(t)+\lambda_{45}p_{4}(t)-\lambda_{34}p_ {3}(t),\\ \frac{dp_{4}(t)}{dt}=\lambda_{51}p_{0}(t)-(\lambda_{35}+\lambda_{45})p_{4}(t), \\ \sum_{i=0}^{4}p_{i}(t)=1.\end{array} \right. \tag{4}\]  
Each equation in the system (4) describes the change in the probability of the SDN being in the \(i\)-th state, depending on the available transitions from this state to other states and vice versa. SDN resilience is a fairly broad concept, even in terms of SDN resilience in the face of CAs, because, as mentioned above, the emergence of new information security threats is a constant process. Therefore, resilience should be considered as the ability of a distributed corporate network using SDN technology to withstand a certain class of CAs. S\({}_{4}\) is the state of SDN operation in case of successful CAs. That is, the probability of the transition of a distributed corporate network using SDN technology is the inverse concept of network resilience. Thus, the flowchart of the proposed technique for assessing the resilience of a distributed SDN under CAs is shown in Figure 4. The technique contains four main stages: (1) the formation of initial data; (2) obtaining the probability values of the system being in state S\({}_{4}\) for the generated data; (3) correction of set parameters; (4) assessment of the impact of the adjusted initial data on the stability of the system under study. The technique allows, when one is determining the most relevant attacks for corporate SDN, users to determine the degree of its resilience. The results obtained and the conclusions based on them make it possible to obtain an adequate assessment of the SDN resilience under simulated conditions to attacks characteristic of this network. However, before evaluating the resilience of SDN, one must first assess the risk of CAs. To do this, it is initially necessary to build mathematical models of CAs based on the verbal model.