Enhancing Load Balancing by Intrusion Detection System Chain on SDN Data Plane
Nadia Niknami, Jie Wu
Abstract
The software-defined network (SDN) allows us to control network flows easily and dynamically. Intrusion detection systems (IDS) are among the controller's applications. The IDS can become overloaded when analyzing a large amount of traffic. Multiple instances of IDSs are recommended across a network to increase processing power. SDN centralized control facilitates the deployment of multiple IDSs on the data plane. This paper proposes a method to deploy some IDS chains, helping the controller increase the detection rate. By grouping flows in a balanced manner and assigning each group to one IDS chain, transmission delay can be reduced. In this study, we formulate an optimization problem to minimize the cost of grouping flows using a modified version of K-means and assigning an IDS chain. We implement our method on a test bed and a trace-based simulation. In various traffic scenarios, our proposed method can satisfy different measurements, such as detection rate and dropping rate, and only increases the delay by a small amount over one IDS scheme.