Towards An SDN Assisted IDS

Sutton, Robert; Ludwiniak, Robert; Pitropakis, Nick; Chrysoulas, Christos; Dagiuklas, Tasos

Abstract

Modern Intrusion Detection Systems are able to identify and check all traffic crossing the network segments that they are only set to monitor. Traditional network infrastructures use static detection mechanisms that check and monitor specific types of malicious traffic. To mitigate this potential waste of resources and improve scalability across an entire network, we propose a methodology which deploys distributed IDS in a Software Defined Network allowing them to be used for specific types of traffic as and when it appears on a network. The core of our work is the creation of an SDN application that takes input from a Snort IDS instances, thus working as a classifier for incoming network traffic with a static ruleset for those classifications. Our application has been tested on a virtualised platform where it performed as planned holding its position for limited use on static and controlled test environments.

Citation

Sutton, R., Ludwiniak, R., Pitropakis, N., Chrysoulas, C., & Dagiuklas, T. (2021, April). Towards An SDN Assisted IDS. Presented at IFIP NTMS Workshop on CyberSecurity on Hardware 2021, Paris, France

• Presentation Conference Type: Conference Paper (published)
• Conference Name: IFIP NTMS Workshop on CyberSecurity on Hardware 2021
• Start Date: Apr 19, 2021
• End Date: Apr 21, 2021
• Acceptance Date: Mar 10, 2021
• Online Publication Date: May 18, 2021
• Publication Date: 2021
• Deposit Date: Jun 19, 2021
• Publicly Available Date: Jun 21, 2021
• Publisher: Institute of Electrical and Electronics Engineers
• Series ISSN: 2157-4960
• Book Title: 2021 11th IFIP International Conference on New Technologies, Mobility and Security (NTMS)
• DOI: https://doi.org/10.1109/NTMS49979.2021.9432651
• Keywords: SDN, IDS, Network Security
• Public URL: http://researchrepository.napier.ac.uk/Output/2651072