# IDSMatch: A Novel Deployment Method for IDS Chains in SDNs +
## 1 Introduction
It may be possible to resolve this problem by deploying a chain of IDSs. It is not possible to install IDS on all switches due to the installation costs and limitations associated with the flow tables. Therefore, it is necessary to limit the number of IDSs. As incoming traffic is grouped, there is no need for many IDSs. Performance measurements can be affected significantly by the grouping and assignment of flows, particularly when high loads are present and transmission delays are caused by non-shortest path routing. In this paper, we discuss how to maintain a balanced flow group and how to match them with IDS chains. This paper presents a design and implementation of SDN to deploy  
Figure 1: Forwarding traffic flows through IDSs in an SDN. IDS on selected switches in the data plane, with the goal of increasing the detection rate and preventing controller overload. We address the challenge of forwarding flows from a source to a destination when traffic passes through specific switches [4]. To this end, we propose a method of flow grouping and matching IDSs for a balance between the detection rate and delay. Our approach involves deploying chains of IDSs across the data plane and redirecting flows through these chains, which can be arranged in either a fixed or dynamic order. However, as IDSs are only placed on certain switches, this can result in additional hops and increased latency. To mitigate this, we also propose a method of grouping incoming traffic to reduce the limitations of maintaining a large flow table and transmission delay, which leads to fewer rules in flow tables and all flows in a group following the same path. We initially used \(K\)-means clustering but found it unsuitable for this problem since each flow has a source and a destination. Therefore, we proposed using a 1-dimensional space to calculate distances in \(G\), where the distance between the two points is the Euclidean distance. We also determined that the number of hops between them should calculate the distance between the source/destination of flows and centroids. We introduce an adapted form of \(K\)-means clustering, featuring a novel distance metric within a two-dimensional (2-D) space. Expanding on the motivation articulated in the prior paper [4], we aim to refine the method, focusing on improvements in delay and balancing factors during the matching and balancing process. The meanings of various symbols used in this study are provided in the Table of Notations (Table 1). Our main contributions to this study are as follows:  
* We introduce a novel approach to deploying chains of IDSs in the data plane, enhancing intrusion detection rates and reducing overload on the controller. This strategic distribution of multiple IDS chains in the data plane not only avoids controller overload but also contributes to effective intrusion detection. * We propose a creative centroid-based modification of the k-means clustering method, which efficiently groups incoming data flows to reduce data transmission delays. * To address the complex joint optimization problem, we present a two-phase algorithm that effectively achieves our optimization goals. * Our paper delves deep into the intricacies of flow grouping and the association of flow groups with IDS chains under varying scenarios. We introduce two distinct models for this association process: the minimum cost 2-D matching and the minimum cost 3-D matching. * We provide a comprehensive evaluation of our approach on a real test bed under various measurements, demonstrating its practical effectiveness in the case of network delay, number of hops, and detection rate. The structure of the paper is as follows: In Section 2, the related works on deploying IDS on SDN, load balancing, and grouping traffic approaches are reviewed. The background and rationale behind the proposed approach are presented in Section 3. The proposed approach, which is based on grouping flows and assigning them to IDS chains,