tim's traffic by creating arbitrarily shorter AS path in the BGP announcement. SENSS can detect this attack by identifying the conflicts in control and data plane, using route query to obtain control plane routing information and using hop-by-hop traffic query to obtain data plane path. To detect the inconsistency, the victim may obtain the control plane routing information from one of the ASes using route query. Next, it verifies the data plane path via the traffic query hop-by-hop from the victim to the attacker, where each SENSS ISP replies with the upstream ISPs for victim's traffic. Once an inconsistency is detected, the victim may ask a set of SENSS ISPs to perform mitigation, that is, use route modification to change the false path segment in the BGP updates to the true data plane path. From the simulation with real traffic traces and Internet topology, we show that with only 18 SENSS ISPs to help mitigate the attack, we can correct 82% of the polluted ASes. 4.6 SDN Traffic Engineering To optimize network costs, performance, and throughput, network operators need to carefully engineer their network traffic. SDN enhances traffic engineering (TE) by offering programmability and global control over the forwarding plane. Recently, service providers have designed centralized TE applications on the SDN controller (e.g., Google's B4 [97] and BwE [98]) to globally compute and enforce optimal paths and bandwidth allocations for all flows in their network. 4 Software-Defined Networks Principles and Applications At first sight, it seems these solutions can be adapted to manage traffic in ISP networks. However, a closer inspection reveals they fall short in satisfying scalability requirements of ISP networks. These SDN-driven TE systems are designed to manage data center (DC) interconnects with at most tens of nodes (e.g., Microsoft's SWAN [99]). However, large ISP networks can consist of tens of thou- sands of forwarding devices. Therefore, global flow optimizations, which are built based on linear programming (LP), 