## 3 System Model and Problem Formulation
### System Model
#### 3.1.3 Security Model  
In any network topology, the degree centrality of a node [38] is the most direct measurement parameter to describe the centrality of a node in SDN. Specifically, the greater the degree of a node, the higher the degree centrality of the node, and the more influential the node is in the network. During network operation, the failure cost of each switch is assigned a different value due to its relative position and degree of influence on the network. Therefore, we define the failure cost of a switch as the degree centrality of a node. As the connectivity of the switch is greater, its relative position is more important in the network. At the same time, if it fails, it will significantly impact the network, so its failure cost will be greater. The failure cost of the switch is calculated by Equation (6):  
\[\varphi_{c}=\frac{\sigma_{c}}{\sum_{m\in N}\sigma_{n}}, \tag{6}\]  
where \(\sigma_{c}\) is the degree centrality of controller \(c\), and \(\sigma_{n}\) is the degree centrality of switch \(n\) in the network. In addition, the betweenness centrality of a link [39] measures how important a link is in the network. Link betweenness is defined as the ratio of the number of paths traversing a link to the total number of shortest paths among all the shortest paths. Specifically, a larger link betweenness means that the role of the link in the network is more critical. Therefore, we define the control link's failure cost as the link's betweenness centrality. If a link fails, the greater the link betweenness, the greater the impact on the network. We expect the set of control paths to contain paths with smaller link betweenness. The failure cost of the control path is calculated by Equation (7):  
\[\varphi_{c_{ij}}=\sum_{i,j\in N}\frac{\sigma_{ij}(e)}{\sigma_{ij}}, \tag{7}\]  
where \(\varphi_{c_{ij}}\) is the edge betweenness of link \(e\) from switch \(i\) to switch \(j\), \(\sigma_{ij}\) is the total number of shortest paths from switch \(i\) to switch \(j\), and \(\sigma_{ij}(e)\) is the number of the shortest paths passing through link \(e\). When the controllers in the SDN adopt the distributed placement method, to ensure all the controllers obtain the same topology information on the whole network, one controller communicates with other controllers regularly. In this paper, we assume that nodes in the network will encounter malicious attacks or hardware and software failures, which cannot be recovered autonomously. In other words, if one or more controllers are attacked from outside, there is a certain probability that the control node or the control link will fail, resulting in information leakage and data loss. Therefore, we expect to enhance the network's security as much as possible to minimize the probability of data loss. The expected percentage of control node failures and the expected percentage of control link interruption are considered as the parameters of security, which are defined by the following formula:  
\[S=\frac{1}{1-\prod\limits_{e_{ij}\in P_{ij}\in C}(1-\varphi_{c})(1-\varphi_{e_{ij }})}, \tag{8}\]  
where \(S\) is the security of the network, and \(P_{ij}\) is the set of shortest control paths between switch \(i\) and controller \(j\). To characterize the impact of link failures on controller deployment results, this paper simulates multiple-link failures to illustrate the impact of reduced security performance on network delay, load, and link overhead. To this end, we employ Support Vector Machine (SVM) [40], a supervised learning method, for predicting link failures. Each link and its state constitute a binary group \((e_{ij},s_{ij})\). When \(s_{ij}=1\), link \(e_{ij}\) is not in failure. When \(s_{ij}=0\), link \(e_{ij}\) is in a disrupted state. We adopt the historical data of link states for link failure prediction. The prediction of link states is a nonlinear binary problem.