uspicion of attacks, SO that the anomaly can be identified sooner. On the other hand, it can inform to collect coarser-grained flow data both spatially and temporally when there is no sign of attacks such that the traffic monitoring load is reduced. Therefore, this adaptive interface can simultaneously improve the accuracy and reduce the overhead. SDN has two key features that enable the design of a flexible flow counting API for anomaly detection. On the one hand, SDN breaks the tight bindings between forwarding and counting. One can install separate wildcard rules on OpenFlow (OF) switches purely for moni- toring purposes, which offers tremendous flexibility in defining the set of packets to count. On the other hand, thanks to the simple interface between control and forwarding plane, one can easily adjust the ele- ments to count, by simply updating the counting rules. This property makes real-time adaptive counting possible. 4 Software-Defined Networks Principles and Applications DoS detector Other anomaly Entropy profiling detectors SDN adaptive anomaly detector Rule installation Adaptive rule update Data preparation Figure 4.8 Adaptive SDN anomaly detection framework. One idea proposed recently is to propose an adaptive flow collec- tion method for anomaly detection in SDN [86]. Benefiting from the nature of SDN, it is programmable, allowing flexible specification of the spatial and temporal properties of counting units (or aggregates). Figure 4.8 shows the key idea of this approach. On the northbound, it provides input to different types of anomaly detectors such as DoS detector, traffic analysis using entropy profiling to detect abnormal dis- tributions, and many other types. On the southbound, it instructs the switches to collect statistics in the entire flow space. It contains three components: the first and the most important component provides the adaptive zooming in the flow space and determines the set of rules to be installed. After that, the second component determines where the rules are to be ins