# IDSMatch: A Novel Deployment Method for IDS Chains in SDNs +
## 1 Introduction  
Software-defined networking (SDN) allows a computer network to be intelligently and centrally controlled through software applications. There is a separation between the control plane (SDN controllers and network applications) and the data plane (switches and their connections) of the network [1]. The network can be programmed and managed more effectively by using a controller. In the SDN application layer, the typical network applications, such as intrusion detection systems (IDS), load balancing, and firewalls, are present [2]. Based on reports received from applications installed, the controller analyzes traffic for forwarding, anomaly detection, and other purposes. There is a possibility of overhead for the controller since there is a large volume of traffic and multiple applications that it must handle [3]. IDS is one of the network applications in SDN. Using IDS, the controller can detect anomalous traffic flows and then install rules in the switch's flow tables in order to block or reroute abnormal traffic. Although the IDS application improves the controller's performance, there are some challenges to implementing intrusion detection. SDN applications for security services result in significant overhead for the controller. It ispossible to reduce the controller's overhead by incorporating security applications, such as IDS and firewalls, into the data plane. The assignment of IDS to all switches can improve detection rates. However, employing IDS on switches is expensive and not feasible within a limited budget. In addition to being costly, IDS requires a considerable amount of time and causes delays in the transmission process. Thus, it would not be helpful to process traffic on all switches along the path from source to destination. Due to the global view and control capabilities of the controller in SDN, significant communication overhead among switches in the data plane is minimized. In the control plane, we offer an application that orchestrates detection actions to facilitate coordination among various IDS in the event of an attack detection. Hence, there is not a significant deal in terms of communication overhead for the data plane. It would be beneficial if we could provide some chains of IDS across the data plane. The result would be a higher attack detection rate and a lower controller overhead. Figure 1 illustrates the application layer, control plane, and data plane in an SDN. The blue dashed lines from the switches to the controller show the control network lines, and the solid black lines between the switches are the data network lines. Originally, there is not any IDS across the data plane. Here, several IDSs are deployed on the switches in the data plane. In the data plane, four switches are equipped with IDS components. This network has some flows, such as \(f_{1}\), \(f_{2}\), and \(f_{3}\). The dashed lines in different colors present the routing path of these three traffic flows: \(f_{1}:s_{1}\to d_{1}\), \(f_{2}:s_{2}\to d_{2}\), and \(f_{3}:s_{3}\to d_{3}\). The controller redirects each of these flows through an alternative path instead of the shortest one, including an IDS chain, to perform intrusion detection. Each IDS chain consists of some IDS components, and there is at least one IDS in every IDS chain. It is reasonable to assume that the lengths of the IDS chains are the same. A measure of the effectiveness of an IDS is its detection rate. The detection rate of blocked malicious packets can be determined by dividing the number of blocked malicious packets by the total number of malicious packets received. The controller is responsible for installing flow rules. Rather than sending traffic to the shortest path, these rules redirect traffic to alternative paths. Intruder detection systems are placed along these alternative paths. It is difficult to determine the best path and to select an IDS chain for each flow. In general, IDS applications cannot achieve an acceptable detection rate due to their limitations.