is sent for extensions. 4.4 SDN Management Besides the basic network control and forwarding, SDN can enable new features in other network management area. In this section, we discuss three areas: measurement, failure recovery, and security. 4.4.1 Anomaly Detection Network flow counting is essential to many network management applications, ranging from network planning, routing optimization, 4.4 SDN Management customer accounting, and anomaly detection. Today, statistics of traffic flows are reported by the routers to the centralized management system. Thus, the impact of network measurement on the network must be minimized. For example, an aggressive monitoring may result in artificial bottlenecks in the network. With too passive a scheme, it may miss important events. Thus, the key challenge is to strike a careful balance between effectiveness (supporting a wide range of applications with accurate statistics) and efficiency (intruding low overhead and cost). Among all the network management applications, from the security perspective, one important question to be answered is how to count flows to provide sufficient information for the network anomaly detection? Existing attempts to achieve a better overhead/accuracy balance is through traffic sampling [85], that is, a router selectively records pack- ets or flows randomly with a preconfigured sampling rate. The thinned traffic is then fed as input to anomaly detection. While being widely deployed as they are simple to implement with low CPU power and memory requirements, studies have shown it to be inaccurate, as it is likely to miss small flows entirely. The network flow measurement should provide a more flexible and more interactive interface to the anomaly detectors SO that the set of flows collected can be dynamically adjusted according to the findings of anomaly detector immediately. There are twofold benefits of such interfaces. On the one hand, the anomaly detector can instruct the flow collection module to provide finer-granularity data once there is a s