Definição de novas regras para o IDS SNORT em redes definidas por software.

Abstract

Software Defined Networking - SDN is a new concept of computer networks as it provides the dissociation between the control plane and the data plane. From this dissociation, the architecture of the networks allows the intelligence to be centralized in a single point. This point has a global view of the network, thus allowing network administrators to manage all services in a simpler way without relying on network equipment manufacturers. With a centralized service and security against fragile intrusion attacks, a successful attack can damage a whole network and give the administrator big problems. Therefore, Intrusion Detection Systems (IDS) are essential for verifying real-time traffic in search of new intrusions that occur daily in a network, allowing the administrator to be able to protect it through these detections found by the system. In this work, we intend to develop new rules for identifying intrusion attacks that can occur in an SDN network through intrusion detection tools that help identify these vulnerabilities, we use the Open Source SNORT system for attack detection, the Mininet emulator To emulate the SDN environment together with the Ryu driver. The THC Hydra tool was used to generate traffic with targeted attacks on the Telnet and FTP services and their packages analyzed by Wireshark to verify some characteristics of the attacks within the test environment. We use the Dataset Darpa 99 that contains a wide base of attacks with the main characteristics of each intrusion to carry out the tests. The results show that the integration between the Ryu controller and Snort was successful, the rules developed in Snort were able to detect attacks against Telnet and FTP, and this same tool sent the alerts to the Ryu controller inside an SDN environment.