# IDSMatch: A Novel Deployment Method for IDS Chains in SDNs +
## 2 Related Work  
In this section, our focus is on the relevant literature pertaining to the utilization of Service Function Chaining (SFC) and the integration of IDS into SDN. The integration of SDN and Network Function Virtualization (NFV) empowers virtualization and enhances network services, with Service Function Chaining being a pivotal mechanism in this context [5]. SFC enables the definition of ordered lists of service functions, dynamically guiding network traffic through diverse service function paths. In [6], the authors introduce a distributed deep reinforcement learning approach, leveraging edge intelligence to deploy Service Chains (SCs). This deployment aims to jointly balance the load on physical nodes and links at the edge. Additionally, in [7], the authors address the deployment of Virtual Network Functions (VNFs) and scheduling arriving requests among computing nodes to achieve low latency and high reliability. They employ state-of-the-art reinforcement learning to formulate an SFC scheduling policy, enhancing the success rate of SFC requests. Several works focus on the detection and prevention of specific types of attacks through the use of SFC [8]. In [9], the combination of multiple SFCs into a Security Service Function Tree (SecSFT) is proposed to optimize resource allocation for virtual security functions. The authors in [10] present a security SFC path selection scheme utilizing deep reinforcement learning. This scheme dynamically selects the optimal path for security SFC in real time using the DQN algorithm, considering the features of incoming traffic and the detection results of security service functions. Furthermore, in [11], a SDN/NFV-enabled security solution is proposed for enterprises, leveraging the commodity hardware to reduce both capital and operational expenditures. During recent years, there has been a considerable amount of research that integrate IDS into SDN [12; 13; 14; 15; 16; 17; 18]. [PERSON] et al. in [19] proposed an efficient multi-level hybrid intrusion detection method for SDNs. A kNN is used as the first level; an Extreme Learning Machine (ELM) is used as the second level; and a Hierarchical Extreme Learning Machine (H-ELM) is used as the third level. According to the experimental study, this system achieves the highest level of accuracy when compared to conventional supervised machine learning algorithms based on the NSL-KDD benchmark dataset. The overall accuracy was significantly improved as a result of this approach. [PERSON] et al. in [20] presented a novel IDS model for SDN that is designed to collect and analyze traffic at the control plane. The proposed IDS model addresses the limitation of the data processing capacity using a probability-based traffic sampling method, using a genetic algorithm that estimates the sampling probability for each sampling point by analyzing the total number of false negatives. Based on the limited detection capacity of the IDS, this technique determines the best sampling rate for each switch. As a result, they improved the effectiveness of intrusion detection under medium network loads. [PERSON] et al. in [21] proposed a mechanism for detecting and defending against DDoS attacks in SDN environments. In order to implement the detection, an unbalanced distribution of traffic was taken into account. An algorithm such as k-means can detect the imbalance in traffic. As an unsupervised machine learning algorithm, k-means enhanced the adaptability of the detection method and allowed the detection of attacks of different scales and types. By using an entropy-based anomaly detection system, [PERSON] et al. in [22] proposed a method of determining a method to detect abnormal traffic variations; they combined entropy and relative entropy. Using KL-divergence, entropy, and machine learning methods simultaneously eliminates the uncertainty associated with the entropy threshold and enhances detection performance. In a study by [PERSON] et al.