|
This figure shows the system configuration and operation of the proposed method.
In this method, the IDS sends alert messages via the syslog protocol, and when the OpenFlow switch receives them, it forwards them to the OpenFlow controller as Packet-In. The OpenFlow controller analyzes the syslog message, identifies the traffic to be blocked, and let the OpenFlow switch block it using the FlowMod command.
Thus, since no log monitoring tools nor REST APIs are used, this method can considerably reduce latency compared with conventional methods.
|