METHOD FOR DETECTING INTRUSION IN NETWORK

• US 20160182541A1
• Filed: 09/22/2015
• Published: 06/23/2016
• Est. Priority Date: 12/18/2014
• Status: Active Grant

• Current Assignee: Gwangju Institute of Science and Technology
• Original Assignee: Gwangju Institute of Science and Technology
• Inventors: KIM, Jong-Won, NARANTUYA, Jargalsaikhan, HA, Tae-Jin, JEONG, Chi-Wook, LIM, Hyuk
• Granted Patent: US 9,876,808 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 43/024 by adaptive sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A method for detecting an intrusion in a network is disclosed. The network includes a plurality of nodes for data transmission/reception and switches for relaying flow transmission/reception between the nodes, and an intrusion detection system (IDS) is combined with the network to form a system The method includes: installing SDN-enabled switches for flow sampling in the network to connect them to SDN controllers; determining, by the SDN controller, the number of network flows and the number of switches; deriving a sampling rate for each of the SDN-enabled switches; forwarding, by the switches, packet information sampled at respective sampling rates to the IDS; and identifying, by the IDS, malicious data based on the packet information to update the sampling rate of each of the SDN switches.

Claims

1. A method for detecting an intrusion in a network, wherein the network comprises a plurality of nodes for data transmission/reception and switches for relaying flow transmission/reception between the nodes, and an intrusion detection system (IDS) is combined with the network to form a system, the method comprising:

installing SDN-enabled switches for flow sampling in the network to connect them to a SDN controller;

determining, by the SDN controller, the number of network to flows and the number of switches;

deriving a sampling rate for each of the SDN-enabled switches;

forwarding, by the switches, packet information to the IDS according to the sampling rate; and

identifying, by the IDS, malicious data based on the packet information to update the sampling rate of each of the SDN switches.

2. The method of claim 1, further comprising:

after the determining, by the SDN controller, the number of the network flows and the number of the switches, deriving a transmission rate of the network flows and path information with a constant IDS capacity.

3. The method of claim 1, wherein the deriving the sampling rate for each of the SDN-enabled switches comprises setting an initial value of a rate at which a malicious attack takes place for each of the network flows.

4. The method of claim 3, further comprising:

deriving a function M(x) that minimizes a maximum value of missing rates of malicious attacks in the IDS using the initial value of the rate at which a malicious attack takes place for each of the network flows.

5. The method of claim 4, wherein an initial value of a sampling rate is derived using the function M(x), and a flow table is created from the SDN controller to the switches to derive a value of sampling rate for each of the switches.

6. The method of claim 5, wherein each of the switches forwards to the IDS the same number of data packets as the number of the SDN controllers included in the flow table.

7. The method of claim 1, wherein the identifying, by the IDS, malicious data based on the packet information to update the sampling rate of each of the SDN-enabled switches comprises

triggering a detection alarm if the IDS detects a malicious traffic to derive a rate at which a malicious attack takes place for the malicious traffic.

8. The method of claim 7, comprising:

estimating a rate at which a malicious attack takes place for each of flows using the rate at which the malicious attack takes place derived by the IDS.

9. The method of claim 8, wherein the rate at which malicious attacks take place for each of the flows is repeatedly estimated by the IDS a predetermined number times to derive an average value of the repeated estimations, and

the sampling rate of each of the switches is derived after the rate at which malicious attacks take place for each of the flows is set to the average value.