You are presented with multiple paper abstracts, alongside the associated literature review and chapter titles. Given the provided information, you are going to do a literature review. Please generate a coherent literature review that synthesizes the content, draws connections between different works, highlights major findings, and identifies any gaps in the existing research.

Literature Review Title: Software Defined Networking Architecture, Security and Energy Efficiency: A Survey 
Chapter Title:  3) Intrusion Attacks in SDN: 
1. Abstract of Cited Paper (BIB001):  There is an increasing desire for programs running at a controller to be able to invoke a rich set of matches and actions that span both the control and data planes. Yet, there is no holistic means to do so. While OpenFlow provides a rich, programmable control plane, it has a fixed/narrow data plane; conversely, although middleboxes, a common way to augment the data plane, provide a sophisticated data plane, they do not integrate well with the control plane in that they do not support a similar match/action interface and they do not inform the controller of in-network events. We envision three broad ways to provide richer matches and actions: 
2. Abstract of Cited Paper (BIB002):  Discovering the causes of incorrect behavior in large networks is often difficult. This difficulty is compounded when some machines in the network are compromised, since these compromised machines may use deception or tamper with data to frustrate forensic analysis. Recently proposed forensic tools enable administrators to learn the causes of some system states in a partially compromised network, but these tools are inherently unable to (1) observe covert communication between compromised nodes or (2) detect attempts to exfiltrate sensitive data. In this paper, we observe that the emergence of Software-Defined Networking (SDN) offers interesting new op- portunities for network forensics. We sketch the design of an SDN-based forensic system that can be used to investigate a wide variety of faults in data center networks, including previously unobservable attacks such as data exfiltration and collusion between compromised nodes. Our key insight is that the network itself can be used as a point of observation, which gives us a holistic view of network activity. We show that a collection of lightweight middleboxes would be sufficient to support this functionality, and we discuss several additional challenges and opportunities for SDN-based forensic tools. 
3. Abstract of Cited Paper (BIB003):  Software-Defined Networking (SDN) introduces significant granularity, visibility and flexibility to networking, but at the same time brings forth new security challenges. One of the fundamental challenges is to build robust firewalls for protecting OpenFlow-based networks where network states and traffic are frequently changed. To address this challenge, we introduce FlowGuard, a comprehensive framework, to facilitate not only accurate detection but also effective resolution of firewall policy violations in dynamic OpenFlow-based networks. FlowGuard checks network flow path spaces to detect firewall policy violations when network states are updated. In addition, FlowGuard conducts automatic and real-time violation resolutions with the help of several innovative resolution strategies designed for diverse network update situations. We also implement our framework and demonstrate the efficacy and efficiency of the proposed detection and resolution approaches in FlowGuard through experiments with a real-world network topology. 
4. Abstract of Cited Paper (BIB004):  Many have recognized the need to restructure the current internet work into a much more dynamic networking environment. It is difficult for today's inflexible infrastructure to cope with the fast changing demands of the users. As a result, Software-Defined Network (SDN) was introduced around 2005 to transform today's network to have centralized management, rapid innovation, and programmability by decoupling the control and data planes. This study focuses on developing a firewall application that runs over an OpenFlow-based SDN controller to show that most of the firewall functionalities are able to be built on software, without the aid of a dedicated hardware. Among many OpenFlow controllers that already exist for the public, we have chosen POX written in Python for the experiment; and to create the SDN network topology, we have used VirtualBox and Mininet. In this study, we cover the implementation detail of our firewall application, as well as the experimentation result. 
5. Abstract of Cited Paper (BIB005):  Cloud infrastructures are composed fundamentally of computing, storage, and networking resources. In regards to network, Software-Defined Networking (SDN) has become one of the most important architectures for the management of networks that require frequent re-policing or re-configurations. Considering the already known security issues of Cloud Computing, SDN helps to give fast answers to emerging threats, but also introduces new vulnerabilities related to its own architecture. In this paper, we analyze recent security proposals derived from the use of SDN, and elaborate on whether it helps to improve trust, security and privacy in Cloud Computing. Moreover, we discuss security concerns introduced by the SDN architecture and how they could compromise Cloud services. Finally, we explore future security perspectives with regard to leveraging SDN benefits and mitigating its security issues.

Literature Review:
The traditional networks have built-in middle boxes (which can integrate IDS, firewall and proxy) and other features to block malicious users. These middle boxes are not available in SDN but are essential to secure the SDN from security attacks in both data plane components and controller. They may not be capable of completely preventing the attacks but can be helpful for enhancing the basic security in SDN. However, integration of these modules in SDN comes with some difficulties as SDN has decoupled structure that relies on centralized controller for all tasks such as updating the policies. Thus, incorporating extra modules may impose the overhead on the controller showing its impact on the entire network. This might result in intrusion attacks in SDN when effect of attacks are overlooked as legitimate overhead on the controller BIB003 . There have been various methods proposed for detecting intrusion attacks in SDN without affecting overall network performance. FlowGuard has been proposed in BIB004 as an SDN firewall and is more sophisticated compared to the firewalls in conventional networks. FlowGuard is associated with a dual functionality to work as packet filter and policy checker. It monitors the network for detecting malicious packets and policy violations in SDN. FlowTag architecture has been proposed in BIB001 for optimizing the system by adding the extended architecture along with the middle-box which tags packets passing through it. This makes it easier to track the missed and malware packets present in the network among others BIB001 , BIB005 . Though the middle boxes have many advantages associated with it, the management of the middle boxes in SDN is the tedious task. NIMBLE architecture has been proposed in  for managing the middle boxes based on the policy rules provided by the administrator. The slick architecture has been proposed in BIB002 for OpenFlow based SDN which is capable of supporting various devices such as NetFPGAs, GPUs and NPs. This method uses a separate control plane to control all operations of middle boxes which enhances the flexibility of SDN. As SDN functions are completely based on the instructions provided by the controller/software, it is more vulnerable to process breaks and the introduction of new bugs can result in reduction of overall performance of SDN BIB006 . According to the recent standard (version 1.3.0) of the openSwitch, the presence of transport layer security (TLS) is not a mandatory option. However, the southbound API of the network, which is more prone to the threats, requires a security layer such as TLS that authenticates users using encryption techniques before granting the access.