applications deployed in the network, which results in increasingly complex traffic and greater and greater network scale. On the other hand, the network environment to be monitored is not confined to traditional networks. It may refer to the data center for cloud computing, the Internet of Things for smart urban sensing, etc. These new changes in network environment also increase the difficulty of the design of efficient monitoring approaches.  
In this case, it is a good idea to propose a flexible monitoring framework and design new efficient monitoring approaches based on it according to the specific monitoring requirements. In this way, the design cost and the deployment cost of efficient monitoring approaches can be greatly reduced. In terms of the monitoring framework, there should be three characteristics described as follows. Firstly, this framework should flexibly support the deployment of monitoring strategies to meet different monitoring requirements. Secondly, this framework could extend the kinds of monitoring data sources. On the one hand, this can better guarantee the monitoring timeliness and the minimal monitoring overhead, while, on the other hand, this can make the analysis of monitoring data simpler. Finally, this framework can be scaled easily without incurring much deployment overhead or monitoring overhead into the network.  
Obviously, by separating the control plane with the data plane, SDN can greatly simplify the network management. However, the SDN management framework cannot be directly applied to the network monitoring. The reason for that is the related monitoring mechanisms are not specifically defined in this framework, which would limit their ability to adequately meet the different monitoring requirements. Taking a variety of the monitoring requirements into account, this paper fully extends the monitoring mechanisms in the SDN management framework while maintaining the advantages of SDN to a great extent. There are mainly four contributions in this paper. (1) This paper proposes a flexible monitoring framework named FlexMonitor, which can flexibly support the design of efficient monitoring approaches according to the specific monitoring requirements. (2) This monitoring framework FlexMonitor extends the kinds of monitoring data sources by introducing the event triggering mechanism. Leveraging this mechanism, FlexMonitor can reduce the monitoring overhead and obtain the network states in a timely manner. (3) The monitoring framework FlexMonitor increases the flexibility of the monitoring strategy deployment. With regard to efficiently carrying out a monitoring task, FlexMonitor can support selectively using some of the monitoring strategies including event definition, switch selection and end-host pair selection. (4) This paper proposes a DDoS (Distributed Denial of Service) detection approach based on the monitoring framework FlexMonitor. By evaluating the performance using NetMagic [6], this approach shows dramatic advantages on the DDoS detection. At the same time, the experimental results verify the flexibility and efficiency of the monitoring framework FlexMonitor.  
The rest of this paper is organized as follows. Section 2 describes the traditional monitoring framework and the related monitoring framework in SDN. Then, the proposed monitoring framework FlexMonitor is presented in Section 3, where the related monitoring mechanisms are also discussed including the deployment of monitoring strategy, the collection of monitoring data, the definition of monitoring request and the scalability of FlexMonitor. Section 4 proposes a DDoS detection approach based on FlexMonitor. Section 5 makes the performance evaluation to verify the efficiency of the proposed DDoS detection approach. Finally, Section 6 presents the conclusion.