# IDSMatch: A Novel Deployment Method for IDS Chains in SDNs +
## 4 IDSMatch: Deploying IDS Chains in SDN
**Definition 1** (Grouping strategy and GroupFlow). : _Grouping strategy \(\Delta\) partitions the incoming traffic flow based on the similarity of specific features, such as the same source or same destination. The total number of groups \(K\) is a predefined parameter. \(F_{j}\subseteq F\) is the \(j\)-th group or \(j\)-th GroupFlow, including multiple flows with similar features. All flows in \(F_{j}\) are routed through the same path and passed through some specific IDSs._  
**Definition 2** (Distance). : _The distance measurement is the summation of the distance of each source \(s_{j}\) to the cluster centroid \(c_{k}\)'s source, and the distance of each destination \(d_{j}\) to the cluster centroid \(c_{k}\)'s destination. Distance value \(dis(s_{j},\overline{s}_{k})+dis(d_{j},\overline{d}_{k})\) is used to find the nearest cluster centroid for each GroupFlow [4]._  
**Definition 3** (Matching GroupFlow with IDS Chain). : _For a specific GroupFlow \(F_{j}\), an IDS chain 1 is assigned by matching the centroid \(c_{k}\) of that GroupFlow with the head of an IDS chain. The assignment is based on the weight of the link between the source of the cluster and the head or tail of the IDS chain [4]._  
Figure 2 illustrates an example for three clusters and three IDS chains. \(h\) represents the head of the IDS chain, while \(t\) signifies the tail of this IDS chain. Figure 2a shows the shortest path method, which calculates the distance between sources and destinations of flows and initial centroids. We have the distance measurement \(dis(s_{j},\overline{s}_{k})+dis(d_{j},\overline{d}_{k})\), and flows would be divided into three clusters with centroids \(\{c_{1},c_{2},c_{3}\}\). The GroupFlows would be assigned to the IDS chain based on the shortest hop count. \(f_{1}(s_{1},d_{1})\), \(f_{2}(s_{2},d_{2})\), and \(f_{5}(s_{5},d_{5})\) are assigned to the first IDS chain based on the shortest path. \(f_{3}(s_{3},d_{3})\) is assigned to the second IDS chain. \(f_{4}(s_{4},d_{4})\) and \(f_{6}(s_{6},d_{6})\) are assigned to the third IDS chain. Figure 2b illustrates the balanced grouping method. After grouping the flows, groups will have different numbers of members. Balanced clustering aims to achieve an equitable distribution of data points within each cluster, ensuring an equal workload for each cluster. Our approach is different from common techniques. Instead of relying on the count of group members to assess balance, we determine balance by considering the total data rate of the groups. For this example, Figure 2a shows that the first cluster has three members, the second one has only one member, and the third one has two members. In order to create balance for the amount of processing on each IDS chain, we make a balance for the totalamount of traffic in each group. The weight of a group can be defined as \(W_{i}=\sum_{f\in F_{i}}n_{i}.w_{f}\). For this example, we assume that the data rate of flow is the same; therefore, balancing would be based on the total number of members in each group. Figure 2b shows the balanced groups. Utilizing a perfect matching algorithm, each balanced GroupFlow is assigned to a head and tail based on the shortest path, which encompasses the sum of hops from the source to the chain's head, the hops between the head and tail, and the hops between the tail and the destination. In Figure 2c, you can observe the allocation of IDS chain heads and tails to the source and destination of the centroids. Every cluster \(K\) has a virtual center, comprising both the source \(\overline{s}_{k}\) and the destination \(\overline{d}_{k}\). The matching process involves connecting \(\overline{s}_{k}\) to \(h_{i}\) and associating \(\overline{d}_{k}\) with \(t_{j}\), where \(h_{i}\) and \(t_{j}\) correspond to the head and tail of two distinct IDS chains. This arrangement results in interconnections between IDS chains. In the real test bed, we consider network delay, which is based on the number of hops and congestion on links. Table 2 shows the hop counts and the assigned IDS chain for each method.