Paper Info
Title
An elastic intrusion detection system for software networks.
Abstract
Internal users are the main causes of anomalous and suspicious behaviors in a communication network. Even when traditional security middleboxes are present, internal attacks may lead the network to outages or to leakage of sensitive information. In this article, we propose BroFlow, an Intrusion Detection and Prevention System based on Bro traffic analyzer and on the global network view of the software-defined networks (SDN) which is provided by the OpenFlow. BroFlow main contributions are (i) dynamic and elastic resource provision of traffic-analyzing machines under demand; (ii) real-time detection of DoS attacks through simple algorithms implemented in a policy language for network events; (iii) immediate reaction to DoS attacks, dropping malicious flows close of their sources, and (iv) near-optimal placement of sensors through a proposed heuristic for strategically positioning sensors in the network infrastructure, which is shared by multi-tenants, with a minimum number of sensors. We developed a prototype of the proposed system, and we evaluated it in a virtual environment of the Future Internet Testbed with Security (FITS). An evaluation of the system under attack shows that BroFlow guarantees the forwarding of legitimate packets at the maximal link rate, reducing up to 90 % of the maximal network delay caused by the attack. BroFlow reaches 50 % of bandwidth gain when compared with conventional firewalls approaches, even when the attackers are legitimate tenants acting in collusion. In addition, the system reduces the sensors number, while keeping full coverage of network flows.
Year
DOI
Venue
2016
10.1007/s12243-016-0506-y
Annales des Télécommunications
Keywords
Field
DocType
DoS attacks, Intrusion detection and prevention system, Software-defined networking, Network security
Network delay,Telecommunications network,Denial-of-service attack,Network security,Network packet,Computer network,OpenFlow,Software-defined networking,Intrusion detection system,Mathematics
Journal
Volume
Issue
ISSN
71
11-12
1958-9395
Citations 
PageRank 
References 
10
0.65
10
Authors
3
Name
Order
Citations
PageRank
Martin Andreoni Lopez1100.99
Diogo M. F. Mattos29715.13
Otto Carlos Muniz Bandeira Duarte368655.46