Method for detecting intrusion in network

Patent metadata

Field	Value
Publication number	US-9876808-B2
Application number	US-201514861665-A
Country	US
Kind code	B2
Filing date	Sep 22, 2015
Priority date	Dec 18, 2014
Publication date	Jan 23, 2018
Grant date	Jan 23, 2018

Abstract

A method for detecting an intrusion in a network is disclosed. The network includes a plurality of nodes for data transmission/reception and switches for relaying flow transmission/reception between the nodes, and an intrusion detection system (IDS) is combined with the network to form a system The method includes: installing SDN-enabled switches for flow sampling in the network to connect them to SDN controllers; determining, by the SDN controller, the number of network flows and the number of switches; deriving a sampling rate for each of the SDN-enabled switches; forwarding, by the switches, packet information sampled at respective sampling rates to the IDS; and identifying, by the IDS, malicious data based on the packet information to update the sampling rate of each of the SDN switches.

First claim

What is claimed is:

1. A method for detecting an intrusion in a network, the method performed by a system, said system comprising the network having a plurality of nodes for data transmission/reception and switches for relaying flow transmission/reception between the nodes, an intrusion detection system (IDS) combined with the network and a Software Defined Networking (SDN) controller, the method comprising:
installing, by the SDN controller, SDN-enabled switches for flow sampling in the network to connect the network to the SDN controller;
determining, by the SDN controller, information on the number of network flows and the number of the switches in the network;
calculating, by the SDN controller, a function M(x), minimizing a maximum value of missing rates of malicious attacks in the IDS, based on an initial value of a rate at which a malicious attack takes place for each of the network flows, where x represents a sampling rate vector of the each of the SDN-enabled switches;
calculating, by the SDN controller, a sampling rate for each of the SDN-enabled switches using a flow table which is created by the SDN controller based on the calculated function M(x);
forwarding, by the SDN-enabled switches, packet information to the IDS according to the calculated sampling rate; identifying, by the IDS, malicious data based on the packet information; and
updating, by the SDN controller, the sampling rate of the each of the SDN-enabled switches based on the identified malicious data.

2. The method of claim 1 , further comprising: calculating, by the SDN controller, a missing rate of the network flows with a constant IDS capacity.

3. The method of claim 1 , wherein the each of the SDN-enabled switches forwards, to the IDS, data packets based on the flow table.

4. The method of claim 1 , wherein the identifying of malicious data comprises when the IDS detects a malicious traffic, triggering a detection alarm to calculate a rate at which a malicious attack takes place for the malicious traffic.

5. The method of claim 4 , further comprising: estimating an estimated rate at which a malicious attack takes place for each of the network flows using the calculated rate.

6. The method of claim 5 , wherein the estimated rate is repeatedly estimated by the IDS a predetermined number times to calculate an average value of the repeated estimations, and
the sampling rate for each of the SDN-enabled switches is calculated based on the calculated average value.

Assignees

• Gwangju Inst Science & Tech

Inventors

• Lim Hyuk
• Kim Jong-Won
• Narantuya Jargalsaikhan
• Ha Tae-Jin
• Jeong Chi-Wook

Classifications

• H04L43/026

  using flow identification · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L43/20

  the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title