IDSMatch: A Novel Deployment Method for IDS Chains in SDNs
With the surge in cyber attacks, there is a pressing need for more robust network intrusion detection systems (IDSs). These IDSs perform at their best when they can monitor all the traffic coursing through the network, especially within a software-defined network (SDN). In an SDN configuration, the...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2024-02-01
|
| Series: | Network |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2673-8732/4/1/3 |
| _version_ | 1827305374151081984 |
|---|---|
| author | Nadia Niknami Jie Wu |
| author_facet | Nadia Niknami Jie Wu |
| author_sort | Nadia Niknami |
| collection | DOAJ |
| description | With the surge in cyber attacks, there is a pressing need for more robust network intrusion detection systems (IDSs). These IDSs perform at their best when they can monitor all the traffic coursing through the network, especially within a software-defined network (SDN). In an SDN configuration, the control plane and data plane operate independently, facilitating dynamic control over network flows. Typically, an IDS application resides in the control plane, or a centrally located network IDS transmits security reports to the controller. However, the controller, equipped with various control applications, may encounter challenges when analyzing substantial data, especially in the face of high traffic volumes. To enhance the processing power, detection rates, and alleviate the controller’s burden, deploying multiple instances of IDS across the data plane is recommended. While deploying IDS on individual switches within the data plane undoubtedly enhances detection rates, the associated costs of installing one at each switch raise concerns. To address this challenge, this paper proposes the deployment of IDS chains across the data plane to boost detection rates while preventing controller overload. The controller directs incoming traffic through alternative paths, incorporating IDS chains; however, potential delays from retransmitting traffic through an IDS chain could extend the journey to the destination. To address these delays and optimize flow distribution, our study proposes a method to balance flow assignments to specific IDS chains with minimal delay. Our approach is validated through comprehensive testing and evaluation using a test bed and trace-based simulation, demonstrating its effectiveness in reducing delays and hop counts across various traffic scenarios. |
| first_indexed | 2024-04-24T17:57:08Z |
| format | Article |
| id | doaj.art-509e59af1b0f41a19d555be715e435c6 |
| institution | Directory Open Access Journal |
| issn | 2673-8732 |
| language | English |
| last_indexed | 2024-04-24T17:57:08Z |
| publishDate | 2024-02-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Network |
| spelling | doaj.art-509e59af1b0f41a19d555be715e435c62024-03-27T13:57:42ZengMDPI AGNetwork2673-87322024-02-0141486710.3390/network4010003IDSMatch: A Novel Deployment Method for IDS Chains in SDNsNadia Niknami0Jie Wu1Center of Networked Computing, Temple University, Philadelphia, PA 19122, USACenter of Networked Computing, Temple University, Philadelphia, PA 19122, USAWith the surge in cyber attacks, there is a pressing need for more robust network intrusion detection systems (IDSs). These IDSs perform at their best when they can monitor all the traffic coursing through the network, especially within a software-defined network (SDN). In an SDN configuration, the control plane and data plane operate independently, facilitating dynamic control over network flows. Typically, an IDS application resides in the control plane, or a centrally located network IDS transmits security reports to the controller. However, the controller, equipped with various control applications, may encounter challenges when analyzing substantial data, especially in the face of high traffic volumes. To enhance the processing power, detection rates, and alleviate the controller’s burden, deploying multiple instances of IDS across the data plane is recommended. While deploying IDS on individual switches within the data plane undoubtedly enhances detection rates, the associated costs of installing one at each switch raise concerns. To address this challenge, this paper proposes the deployment of IDS chains across the data plane to boost detection rates while preventing controller overload. The controller directs incoming traffic through alternative paths, incorporating IDS chains; however, potential delays from retransmitting traffic through an IDS chain could extend the journey to the destination. To address these delays and optimize flow distribution, our study proposes a method to balance flow assignments to specific IDS chains with minimal delay. Our approach is validated through comprehensive testing and evaluation using a test bed and trace-based simulation, demonstrating its effectiveness in reducing delays and hop counts across various traffic scenarios.https://www.mdpi.com/2673-8732/4/1/3attackforwarding trafficintrusion detectionload balancingSDNmatching problem |
| spellingShingle | Nadia Niknami Jie Wu IDSMatch: A Novel Deployment Method for IDS Chains in SDNs Network attack forwarding traffic intrusion detection load balancing SDN matching problem |
| title | IDSMatch: A Novel Deployment Method for IDS Chains in SDNs |
| title_full | IDSMatch: A Novel Deployment Method for IDS Chains in SDNs |
| title_fullStr | IDSMatch: A Novel Deployment Method for IDS Chains in SDNs |
| title_full_unstemmed | IDSMatch: A Novel Deployment Method for IDS Chains in SDNs |
| title_short | IDSMatch: A Novel Deployment Method for IDS Chains in SDNs |
| title_sort | idsmatch a novel deployment method for ids chains in sdns |
| topic | attack forwarding traffic intrusion detection load balancing SDN matching problem |
| url | https://www.mdpi.com/2673-8732/4/1/3 |
| work_keys_str_mv | AT nadianiknami idsmatchanoveldeploymentmethodforidschainsinsdns AT jiewu idsmatchanoveldeploymentmethodforidschainsinsdns |