Fast Blocking of Malicious Traffic by Excluding Benign Flow Monitoring in IDS/SDN Cooperative Firewall Systems

Intrusion Detection System (IDS) / Software Defined Networking (SDN) cooperative firewall systems attract much attention recently because they have many advantages such as dynamic network configuration with SDN and scalable IDS hosts. In IDS/SDN cooperative firewall systems, an SDN switch relays traffic between external and internal networks and mirrors the traffic to an IDS host. The IDS host monitors mirrored traffic and tells the SDN controller to block malicious traffic according to attack detection. Therefore, when the IDS hosts are overloaded, it causes a large delay between attack detection by the IDS host and malicious traffic blocking in the SDN switch, which increases the amount of malicious traffic reaching the server. In this paper, we propose a configuration to reduce the loads on the IDS hosts by excluding benign flows from packet monitoring. By using the proposed configuration, IDS hosts reduce the long delay in blocking because the proposed configuration mitigates the performance degradation in IDS hosts due to monitoring of all traffic, including known benign flows. We implemented the proposed configuration on our IDS/SDN cooperative firewall systems using real devices. Then we evaluated the effectiveness of delay reduction with and without excluding benign flows when varying the number of IDS hosts and the notification method used for blocking malicious traffic, namely using Syslog messages and using REST API. As a result, we confirm that the proposed configuration reduces the delay time in all cases investigated. Furthermore, we confirmed that Syslog notifications are faster than REST API notifications in all cases.