# IDSMatch: A Novel Deployment Method for IDS Chains in SDNs +
## 2 Related Work
[23], a novel approach to attack detection within the data plane, centered on SDN architecture, is presented. Their work introduced a zone-based architecture for KIDS (Kangaroo Intrusion Detection System) to enhance scalability and anomaly detection. An innovative IDS design was employed, which leverages consecutive jumps after attack detection to efficiently notify the SDN controller and other IDScomponents. [PERSON] et al. [24] introduced a methodology for traffic categorization rooted in a correlation model. Their approach assesses traffic flow similarity using Euclidean distance and examines flow connectivity by considering factors such as flow occurrence time, source and destination IP addresses, port pairs, and the Transport-Layer protocol. To alleviate the controller's load and enhance attack detection rates, [PERSON] et al. proposed a distinctive extension for SDN [4]. They advocated for the deployment of IDSs in the data plane, where a chain of IDSs is interconnected with various switches. This novel approach incorporates a new distance measurement technique and a modified version of the \(K\)-means algorithm to group incoming data flows and steer flow groups toward the IDS chains. The authors in [25] introduced a novel approach called Reconstruction from Partial Observation (RePO) for constructing a network IDS. Their method leverages denoising autoencoders, demonstrating their effectiveness in detecting diverse network attacks with minimal false alerts. RePO exhibits enhanced robustness against adversarial example attacks, surpassing the accuracy of current state-of-the-art methods in building a more effective and resilient network IDS in [26]. The present paper expands on the findings presented in [4]. The utilization of multiple IDSs, in contrast to a single IDS, increases the likelihood of detecting anomalous flows. The previous study [4] investigated controller overhead, drop rates, missing rates, and detection rates across various scenarios involving attack rates and different scales of traffic. Their results demonstrated that increasing the number of IDSs has a positive impact on detecting malicious packets. However, it is crucial to note that the controller directs incoming traffic through alternative paths, incorporating IDS chains, and potential delays may arise from retransmitting traffic through an IDS chain, thus elongating the journey to the destination. To mitigate these delays and optimize flow distribution, the current study proposes a method to balance flow assignments to specific IDS chains with minimal delay. The primary objective of this paper is to present \(K\)-means clustering and subsequent matching and balancing between virtual centers and IDS. The experimental section includes entirely new evaluations. In our approach, the location of IDS is any switch in the given network, and it can be the center for multiple clusters. We run \(K\)-mean and adjust the location of groups based on closeness for the distance of flow and centroid of groups. Then, by providing balanced groups and assigning flow groups to IDS chains, the controller installs a forwarding rule for each group.