# Trade-offs between Risk and Operational Cost in SDN Failure Recovery Plan
## 3 Design Framework
Note that the average path length is about 4.3, and the percentage of the flows that require more than 5 flow operations for recovery is negligible. This suggests a simple rule of thumb: In order to restore a significant portion of the restorable flows, the operational cost should be kept smaller or equal to the average path length. In this example, with a maximum of \([4.3]^{+}=5\) flow operations, 98% of the restorable flows can be rerouted to the low-risk paths. More than 50% of the restorable flows can be restored only with an operational cost smaller or equal to half of the path length, i.e., with a maximum of \([4.3/2]^{+}=3\) flow operations. This suggests another rule of thumb that the majority of the restorable flows can be restored with an operational cost of smaller or equal to half of the average path length. In order to make efficient and timely restoration, the following recommendations must be taken into consideration:  
Figure 4: The maximum allowed total operational cost \(\eta\) versus the minimum obtained survivability probability in P1. * The flows that require the lowest flow operations must be given priority in restoration;
* Not every restoration is successful, and, in some cases, a low-risk path can never be found;
* The maximum number of allowed flow operations should not exceed the average path length;
* To restore the majority of the restorable flows, the operational cost should be kept smaller or equal to the average path length. To restore a significant number of restorable flows, the operational cost should be kept smaller or equal to half of the average path length. Instead of using a similar risk threshold \(\tau\) in P4 for all the flows, a different approach is to change \(\tau\) adaptively for different flows. For instance, when applying a single risk threshold of \(\tau=-\log\left(0.5\right)\) to all the flows, only 44% of the overall flows can be restored, whereas 73% of the overall flows can be rerouted to lower-risk paths (with risks smaller than that of the original path yet not necessarily smaller than \(-\log\left(0.5\right)\)). Let \(\tau_{\min}\) denote the lowest risk that a given flow can achieve regardless of the operational cost. Note that \(\tau_{\min}\) can be obtained employing [PERSON]'s algorithm. If the risk threshold was set at \(\tau_{\min}\), the operational cost would be the highest. In order to decrease the operational cost, we allow leeway in the risk threshold. Hence, we propose setting the risk threshold as \(\tau=r+\tau_{\min}\), where \(r\geq 0\). As such, the value of \(r\) is fixed for all the flows while \(\tau\) varies for different flows since \(\tau_{\min}\) is different for different paths. Figure 6 shows the relation between the risk threshold and the adaptive risk \(r\), and Figure 7 depicts operational cost when the adaptive risk thresholding is employed for three different paths:  
Figure 5: Individual Operational Cost Survivability Trade-off. Figure 6: Risk threshold versus adaptive risk threshold. * **Original paths:** Paths with the lowest risk when the prior values of \(\{p_{ij}\}\) are considered;
* **Lowest-risk paths:** Paths with the lowest risk when the current values of \(\{p_{ij}\}\) are considered;
* **Intermediate-risk paths:** Otherwise. Notice that only the risk and operational cost of the intermediate paths depend on \(r\). For smaller values, the constraint on the risk is very tight, and consequently, the intermediate path will have a high average operational cost \(\eta_{avg}\) and low average risk. As \(r\) increases, the constraint on risk becomes less tight. As such, higher risk is permitted while the operational cost decreases. The decrease in operational cost also means that, in some cases, restoration of the original flow is unnecessary as it satisfies the risk constraint. For instance, for \(\log(r)>0.2\), the average operational cost is smaller than one. This means that many paths need not be rerouted.