Quick Blocking Operation of Firewall System Cooperating with IDS and SDN
Issued Date
2022-01-01
Resource Type
ISSN
17389445
Scopus ID
2-s2.0-85127515663
Journal Title
International Conference on Advanced Communication Technology, ICACT
Volume
2022-February
Start Page
393
End Page
398
Rights Holder(s)
SCOPUS
Bibliographic Citation
International Conference on Advanced Communication Technology, ICACT Vol.2022-February (2022) , 393-398
Suggested Citation
Katsura Y., Sakarin P., Yamai N., Kimiyama H., Visoottiviseth V. Quick Blocking Operation of Firewall System Cooperating with IDS and SDN. International Conference on Advanced Communication Technology, ICACT Vol.2022-February (2022) , 393-398. 398. doi:10.23919/ICACT53585.2022.9728831 Retrieved from: https://repository.li.mahidol.ac.th/handle/20.500.14594/84644
Title
Quick Blocking Operation of Firewall System Cooperating with IDS and SDN
Author(s)
Other Contributor(s)
Abstract
Firewalls, intrusion detection systems (IDSs), and intrusion prevention systems (IPSs) are normally used to filter anomaly traffic and prevent attacks from the Internet. However, preconfiguring firewalls and IDS on multiple devices is an exhausting work for the network administrators. Software Defined Network (SDN) is the concept proposed to make the network management easier by using an SDN controller and SDN switches. In this research, we propose a system that integrates IDS together with SDN in order to block anomaly traffic in a fast manner. Once the IDS detects anomaly traffic, it will send an alert message back to the SDN switch. Then, this alert message will be sent as a PacketIn message to the SDN controller in order to set up rules to block the attack. To evaluate our system, we conduct experiments to compare the performance of our proposed system using syslog and Socket API with the existing method that uses REST API, and another comparison method, in term of processing time. Our experiment results confirm that our proposed method can result in the smaller latency and can quickly block malicious traffic.