Research Article
SDN-Based Kernel Modular Countermeasure for Intrusion Detection
@INPROCEEDINGS{10.1007/978-3-319-78813-5_14, author={Tommy Chin and Kaiqi Xiong and Mohamed Rahouti}, title={SDN-Based Kernel Modular Countermeasure for Intrusion Detection}, proceedings={Security and Privacy in Communication Networks. 13th International Conference, SecureComm 2017, Niagara Falls, ON, Canada, October 22--25, 2017, Proceedings}, proceedings_a={SECURECOMM}, year={2018}, month={4}, keywords={Aho-Corasick Bloom filters Intrusion detection system Security Software Defined Networking (SDN)}, doi={10.1007/978-3-319-78813-5_14} }- Tommy Chin
Kaiqi Xiong
Mohamed Rahouti
Year: 2018
SDN-Based Kernel Modular Countermeasure for Intrusion Detection
SECURECOMM
Springer
DOI: 10.1007/978-3-319-78813-5_14
Abstract
Software-Defined Networking (SDN) is a core technology. However, Denial of Service (DoS) has been proved a serious attack in SDN environments. A variety of Intrusion Detection and Prevention Systems (IDPS) have been proposed for the detection and mitigation of DoS threats, but they often present significant performance overhead and long mitigation time so as to be impractical. To address these issues, we propose KernelDetect, a lightweight kernel-level intrusion detection and prevention framework. KernelDetect leverages modular string searching and filtering mechanisms with SDN techniques. By considering that the Aho-Corasick and Bloom filter are exact string matching and partial matching techniques respectively, we design KernelDetect to leverage the strengths of both algorithms with SDN. Moreover, we compare KernelDetect with traditional IDPS: SNORT and BRO, using a real-world testbed. Comprehensive experimental studies demonstrate that KernelDetect is an efficient mechanism and performs better than SNORT and BRO in threat detection and mitigation.