Security and Privacy in Communication Networks. 13th International Conference, SecureComm 2017, Niagara Falls, ON, Canada, October 22–25, 2017, Proceedings

Research Article

SDN-Based Kernel Modular Countermeasure for Intrusion Detection

Download
327 downloads
  • @INPROCEEDINGS{10.1007/978-3-319-78813-5_14,
        author={Tommy Chin and Kaiqi Xiong and Mohamed Rahouti},
        title={SDN-Based Kernel Modular Countermeasure for Intrusion Detection},
        proceedings={Security and Privacy in Communication Networks. 13th International Conference, SecureComm 2017, Niagara Falls, ON, Canada, October 22--25, 2017, Proceedings},
        proceedings_a={SECURECOMM},
        year={2018},
        month={4},
        keywords={Aho-Corasick Bloom filters Intrusion detection system Security Software Defined Networking (SDN)},
        doi={10.1007/978-3-319-78813-5_14}
    }
    
  • Tommy Chin
    Kaiqi Xiong
    Mohamed Rahouti
    Year: 2018
    SDN-Based Kernel Modular Countermeasure for Intrusion Detection
    SECURECOMM
    Springer
    DOI: 10.1007/978-3-319-78813-5_14
Tommy Chin1,*, Kaiqi Xiong2,*, Mohamed Rahouti2,*
  • 1: Rochester Institute of Technology
  • 2: University of South Florida
*Contact email: tommy.chin@ieee.org, xiongk@usf.edu, mrahouti@mail.usf.edu

Abstract

Software-Defined Networking (SDN) is a core technology. However, Denial of Service (DoS) has been proved a serious attack in SDN environments. A variety of Intrusion Detection and Prevention Systems (IDPS) have been proposed for the detection and mitigation of DoS threats, but they often present significant performance overhead and long mitigation time so as to be impractical. To address these issues, we propose KernelDetect, a lightweight kernel-level intrusion detection and prevention framework. KernelDetect leverages modular string searching and filtering mechanisms with SDN techniques. By considering that the Aho-Corasick and Bloom filter are exact string matching and partial matching techniques respectively, we design KernelDetect to leverage the strengths of both algorithms with SDN. Moreover, we compare KernelDetect with traditional IDPS: SNORT and BRO, using a real-world testbed. Comprehensive experimental studies demonstrate that KernelDetect is an efficient mechanism and performs better than SNORT and BRO in threat detection and mitigation.