 |
This figure shows the system configuration and operation of the conventional method.
In this method, the IDS records an alert message to the log file, and when the log monitoring tool finds the traffic to be blocked, it alerts the OpenFlow controller to block it using the REST API. The OpenFlow controller issues the FlowMod command to let the OpenFlow switch block the target traffic.
This operation generates two types of latency: one is the latency caused by log monitoring, which is the time interval from when the IDS records an alert message to the log file to when the log monitoring tool recognizes it, and the other is the latency caused by TCP connection establishment because the log monitoring tool communicates with the OpenFlow controller using the REST API over TCP.
|
IEEE/ICACT20220162 Slide.07
[Big Slide]
[YouTube]