scope:

This Recommendation supports the protection of network resources using security services based on software-defined networking (SDN). This Recommendation covers:

- classification of the network resources that can be protected by SDN-based security services;

- definition of security services based on SDN;

- specification of the implementation of SDN-based security services.

The protection of network resources (e.g., router, switch, firewall and intrusion detection system) by SDN-based security services means:

- prompt reaction to new network attacks [e.g., worms and distributed denial-of-service (DDoS) attacks];

- construction of private networks to mitigate sophisticated network attacks;

- automatic defence from network attacks without the intervention of network administrators;

- dynamic network-load-aware resource allocation.