ICACT20220162 Question.1
Questioner: spcho@hanmail.net 2022-02-10 오후 1:00:58 |
ICACT20220162 Answer.1
Answer by Auhor vasaka.vis@mahidol.edu 2022-02-10 오후 1:00:58
Chrome  Click!! |
| The difference between the existing method and the proposed method seems to be different depending on the attack packet pattern. For example, is the result the same even if the attack pattern is a burst pattern and a random pattern? |
No, the attack pattern is not a matter.
Whatever type of attack will be detected by our Snort IDS.
Therefore the accuracy of attack detection is based on the Snort's performance, which is out of our scope.
In this work, we just want to prove that we can reduce the time latency (from when we got the attack until we can block the attack) by applying our proposed method.
Thank you very much for your questions :) |
ICACT20220162 Question.2
Questioner: spcho@hanmail.net 2022-02-10 오후 12:58:56 |
ICACT20220162 Answer.2
Answer by Auhor vasaka.vis@mahidol.edu 2022-02-10 오후 12:58:56
Chrome Click!! |
| In the presented method, delays are likely to occur when exchanging the syslog protocol. How much is the delay according to the syslog protocol exchange? |
There is no delay in the syslog protocol. We just sent the syslog message in the syslog format, not the syslog protocol between the IDS and the Open vSwitch.
Just the message (log) in the syslog format is sent via UDP as PacketIn back to Open vSwitch. And because it is UDP, it is faster than using RestAPI with TCP connection. |
ICACT20220162 Question.3
Questioner: tomayoon@ieee.org 2022-02-15 오후 12:11:22 |
ICACT20220162 Answer.3
Answer by Auhor vasaka.vis@mahidol.edu 2022-02-15 오후 12:11:22
Chrome Click!! |
| First of all, thank you for the good research paper and presentation contents. I would like to know more about the research environment used in this study, and also in detail about the equipment & operating systems, development languages and software libraries you used. |
Thank you for your comments.
Hardware and software specifications are listed on Slide 10 "Specifications". We used Raspberry Pi 2 Model B to prove our concepts. For software, we used Ryu 2.7 as the OpenFlow controller, and Open vSwitch 2.3.0 for OpenFlow switch. Snort 2.9.9 was used as an IDS. |
ICACT20220162 Question.4
Questioner: yohira@yamaguchi-u.ac.jp 2022-02-15 오후 12:16:53 |
ICACT20220162 Answer.4
Answer by Auhor vasaka.vis@mahidol.edu 2022-02-15 오후 12:16:53
Chrome Click!! |
| Is there any difference in the amount of information obtained when the log monitoring tool monitors the log and the OpenFlow controller analyzes the Syslog messages? |
Thank you very much for your question. Actually, our syslog information was generated by Snort IDS. Our Snort will generate the log just when it found malicious traffic. Therefore, it is not the same information you get from the normal log monitoring tool that generate logs from other events and not limited to malicious traffic. So, it will be different amount of information.
On the OpenFlow controller, we developed a small module to receive and analyze syslog information from our Snort IDS and feed this information to OpenFlow's flow table. |
ICACT20220162 Question.5
Questioner: namacabale@gmail.com 2022-02-15 오후 5:40:18 |
ICACT20220162 Answer.5
Answer by Auhor vasaka.vis@mahidol.edu 2022-02-15 오후 5:40:18
Chrome Click!! |
| Dear Author, you have a very good research. In many engineering work it's hard to address issues all at the same time. Somehow to address some issues you need to trade or give up some advantages. In your work, what specific aspect(s) was/were sacrificed or ignored to achieve your goal. |
Thank you for your question :)
Integrating IDS and SDN is also proposed by other research work. In our work, we just aim to reduce the latency between the IDS alert and the process in blocking traffic by the SDN controller. However, in the network architecture used in the experiments may not be able to handle high volume of traffic. That is why we propose a solution for the future work. |
ICACT20220162 Question.6
Questioner: dasuni@korea.ac.kr 2022-02-16 오전 8:46:16 |
ICACT20220162 Answer.6
Answer by Auhor vasaka.vis@mahidol.edu 2022-02-16 오전 8:46:16
Chrome Click!! |
| Dear author, you have a very interesting research. I wonder how many switches you experimented with in the proposed method. Did you also conduct an evaluation of cases where multiple switches were used? |
For this paper, we used only one Open vSwitch, but for the current on-going research work, we use multiple switches. |
