Sistema de detecção e prevenção de ataques port scan em redes OpenFlow SDN.

Abstract

Security has been one of the major concerns in computer networks comunity due to resource abuse and malicious flows intrusion. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) have been widely used in traditional networks to provide security. However, with the growth and the evolution of the Internet, many alternatives were not used because of the lack of a global development framework and testing in real environments. The new paradigm called Software Defined Networking (SDN) and the OpenFlow protocol, brought greater flexibility to programming new protocols and performing tests in real environments, besides the possibility of implementationn in production environments. One the other hand, the simple migration of traditional IDS/IPS alternatives to an SDN environment is not efective enough to detect and prevent attacks. Several studies are addressing IDS/IPS methods for SDN, based on received flows data analysis. A flow data analysis, can lead to an increase in switching latency of the switches, due to the need to analyze the packet before routing it. There may also be network overhead when the packet is duplicated to be parsed by an external IDS in parallel with the packet forwarding. These problems make the IDS/IPS a bottleneck, and based on this context and benefited by the flexible features of SDN, this work presents a new port scan IPS for SDN based on the OpenFlow switch counters data. This work results on a non-intrusive and lightweight architecture, with low network overload and processing power consumption. The results show that our method was efective on detecting port scan attacks.