Abstract:As traditional networks, the software-defined campus network also suffers from intrusion attacks. Current solutions for intrusion prevention cannot meet the requirements of the campus network. Existing methods of attack traceback are either limited to specific protocols or incur high overhead. To protect the data center (DC) of the campus network from internal and external attacks, we propose an Intrusion Prevention System (IPS) based on the coordinated control between the detection engine, the attack traceback agent, and the software-defined control plane. Our solution includes a novel algorithm to infer the best switch port for defending different attacks of varied scales based on the inverse HSA (Header Space Analysis) and the global view of the software-defined controller. The proposed scheme can effectively and timely block the malicious traffic not only protecting victim hosts from attacks but also preventing the whole network from suffering unwanted transmission burden. The proposed IPS is deployed on the bypass of the DC switch and collects network traffic by port mirroring. Compared with the traditional serial deployment, the new design helps defend the DC internal attacks, reduce the probability of network congestion, and avoid the single point of failure. The experimental results show that the overhead of our IPS is very low, which enables it to meet the real-time requirements. The average defense time is between 10 and 14 ms for the data center internal attacks of different scales. For external attacks, the maximum defense time is about 76 ms for a large-scale network with 100 switches.

Design and Implementation of Central-controller in Tridimensional Defense System

Network Safeguard System Based on IDXP

Insights on Cooperative Defense for Multiple Industrial Security Technologies

Multi-agent based hybrid Intrusion detection system

Research on Information Security Model and Security System Design

Research on the Security Defense Architecture of the Closed-source Power Industrial Control System

A Distributed Intrusion Detecting System Based on Tridimensional Agent

Design on Combination System of Distributed Firewall and Invading Detection

Design And Implementation Of A Dids

Design and Realization of Evaluation Environment for Intrusion Detection Systems

Design and Implementation of Distributed Intrusion Detection System Based on P2DR Model

Research on IDS-based Distributed Firewall System

Design and Implementation of a Distributed Cooperative Intrusion Detection System

Design of Concurrent Immune IDS System with Three Protection-Layers Based on IXP2350

Design of Advanced IDS Architecture for Electricity Information Networks

A Framework of Network Attacker-Tracing System

A Distributed and Autonomous Guard System Based on Cloud Environments

Design and implementation of computer network security detection and control system

Design for Dual Network Defense System

The Computer Control of Security System for Garrison Area

Intrusion prevention with attack traceback and software-defined control plane for campus networks