INTRUSION DETECTION

SYSTEM USING SOFTWARE

DEFINED NETWORKING

SDN BASED IDS

There are three methods to secure the network in SDN
framework;

1. By implementing security services as SDN controller

application.

2. SDN firewall application. Using flow tables implement

security policies.

3. Integrating the traditional IDS with SDN architecture.

CONTROLLER INFORMATION CHANNEL

CONTROLLER INFORMATION CHANNEL

PACKET LEVEL INFORMATION

There are two ways for an OpenFlow controller to access
packet level information.

1. Do not install flow rules.

2. To divert packets to a monitoring terminal.

LIMITATION
Approach 1:
Potential Bottleneck
Increased packet delivery time
Switch may buffer the packets
Approach 2:
High network overhead
Unnecessary overhead
Complex monitors required

FLEXAM
Flexible sampling extension for monitoring and security applications in
OpenFlow.

Per-flow sampling as a new information channel between controller and data

path elements.

Gives the controller access to packet-level information

The controller defines

Which flows need to be sampled

Inside a given flow how samples are selected
What part of each packet is selected
Where the samples are sent to

SAMPLING
Two types of sampling is used in the proposed solution.

Stochastic Sampling
Deterministic Sampling

APPLICATIONS
Various potential applications

Traffic classification
Quality of service
Diagnostics and troubleshooting
In depth look at

Port scan detection

Elephant flow detection
Accuracy vs. load trade-off

CONCLUSION
Proposed FleXam

Flexible sampling extension for OpenFlow

Enables the controller to access packet-level information
Flexible for different applications
Yet simple enough to be implemented entirely in switch data-path and operate at
line rate

Demonstrated how to implement port scan detection with FleXam

An example of security applications that need access to packet-level information

FIREWALL
Floodlight is a signature based firewall, the first packet of
each flow triggers a packet-in message which is compared
with a set of existing firewall rules.

Fort-NOX a security policy enforcement kernel as an

extension to the open source NOX OpenFlow controller. It
incorporates a live rule conflict detection engine, which
mediates all OpenFlow rule insertion requests.

IDS TOOLS
SnortFlow
BroFlow

SDN ALTERNATIVES FOR OPENFLOW

PCE
ALTO
I2RS
ACTN
SR

REFERENCES
Shirali-Shahreza, Sajad, and Yashar Ganjali. "Flexam: Flexible sampling extension for
monitoring and security applications in openflow." Proceedings of the second ACM
SIGCOMM workshop on Hot topics in software defined networking. ACM, 2013.

Mehdi, Syed Akbar, Junaid Khalid, and Syed Ali Khayam. "Revisiting traffic anomaly

detection using software defined networking." Recent Advances in Intrusion Detection.

Springer Berlin Heidelberg, 2011.

Project Floodlight,. "Floodlight Openflow Controller -". N.p., 2016. Web. 12 Jan. 2016.
Porras, Philip, et al. "A security enforcement kernel for OpenFlow networks." Proceedings
of the first workshop on Hot topics in software defined networks. ACM, 2012.

Xing, Tianyi, et al. "Snortflow: A openflow-based intrusion prevention system in cloud

environment." Research and Educational Experiment Workshop (GREE), 2013 Second

GENI. IEEE, 2013.