Suspicious traffic detection in SDN with collaborative techniques of snort and deep neural networks

Software Defined Networks (SDN) with OpenFlow (OF) based protocol tend to transform traditional network architecture to vendor independent architecture with data-plane and control-plane programmability. This programmability provides a rich functionality in central traffic management, switch configuration, Intrusion Detection System (IDS) integration and global view of entire deployed infrastructure. The SDN network comprises single point failure vulnerability mainly at central controller unit, the deployment of standalone legacy IDS sensors cannot guarantee for safeguard against intruders. Therefore, in the first stage of proposed work, a signature-based Snort IDS is implemented for malicious activity detection and traffic monitoring with traffic mirroring in Open vSwitch (OVS), then store in csv log file of Barnyard 2. In second stage, for the purpose of effective attack detection in the test-bed, a flowbased anomaly detection is deployed with Deep Neural Networks (DNN) to improve the signature-based IDS limitation with higher detection rate with low false-positive triggers. To assess the efficacy of our proposed collaborative detection technique, a testbed is developed to simulate malicious and benign traffic. From the simulation results, our collaborative detection mechanism achieved more than 90% true positive rate with less than 5% of false alarms for all TCP, UDP and ICMP attacks in general, demonstrating effective malicious traffic detection method as compared to conventional signature based methodologies.