# IDSMatch: A Novel Deployment Method for IDS Chains in SDNs +
## 3 Background and Motivation  
This paper aims to deploy IDS chains across a data plane to increase the attack detection rate and decrease overhead on the controller when there is a large amount of traffic in the SDN. An IDS describes a suspected intrusion and then signals an alarm once it has happened [27]. Regarding detection techniques, IDS can be divided into three categories: signature-based (knowledge-based), anomaly-based (behavior-based), and hybrid. A signature-based IDS detects network traffic for signs of attacks and uses those signatures as a reference to detect future attacks. An anomaly detection IDS detects traffic anomalies based on tracking them. It is the hybrid IDS that uses both knowledge and anomaly technologies. By using hybrid detection, it is possible to identify both predefined and undefined intrusions [28]. Similarly, IDSs can be categorized into three types according to their data collection techniques--host-based, network-based, and hybrid systems, which combine two approaches [29]. The SDN architecture separates the control plane's decision-making from the data plane's traffic forwarding while logically centralizing decision-making into a controller whose functionality can be extended via network applications. A centralized control plane provides a global view in SDN, enabling traffic engineering, security, load balancing, and other network management strategies to be implemented based on defined network policies. All switches in the network are monitored by the controller, which sets rules in the flow tables on each switch. Through the use of OpenFlow [30], a centralized controller communicates with switches and handles the routing and forwarding of the data plane. The controller monitors all switches in the network and sets rules for each switch'sflow tables. Switches send packet-in messages to controllers whenever new packets arrive that do not match entries in the flow table. An SDN-based IDS detects and reports malicious behavior or attacks to the controller. In SDN, the IDS is currently designed using a machine learning approach [31]. A machine learning-based IDS can be trained more easily with the centralization of the SDN [32]. Clustering algorithms are designed to partition the set of nodes into distinct clusters, and the challenge revolves around choosing the cluster head, often referred to as the centroid, and effectively managing these clusters. The \(K\)-means clustering technique aims to group similar items into clusters [33]. Each cluster begins with centroids selected at random, and then the positions of these centroids are optimized iteratively. The centroid of a cluster represents its central point. In the \(K\)-means algorithm, \(K\) centroids are determined, and each data point is assigned to the nearest cluster, with the goal of minimizing the size of these centroids. \(K\) is a hyper-parameter to the \(K\)-means algorithm. There is usually a heuristic approach to determining the number of clusters \(K\). Most strategies involve running \(K\)-means with a variety of \(K\) values in order to determine which value is the most appropriate. In order to solve minimum-cost assignment problems [34], the balanced \(K\)-means algorithm can be implemented using the Munkres algorithm [35] or the Hungarian algorithm [36]. Matching problems are generally concerned with finding a set of edges whose vertex belongs to at least one of these edges. Suppose a network \(G\) has \(|V|\) nodes and a set of links \(E\) between nodes \(v\in V\). In the _Weighted Matching_ method, there is weight for the edges, and the algorithm tries to identify a set of disjoint edges that have the greatest weight sum. A bipartite graph consists of two vertex sets of equal size [37], and the _Perfect Weighted Matching_ algorithm is intended to generate an edge set on this graph. The authors in [38] presented an extension of Weighted Matching called the _Weighted 3-D Matching_ algorithm by utilizing 3-D hyper-graphs.