 |
First, we show the difference between the conventional method and the comparison method.
The time intervals between when an attack packet was mirrored and when the IDS sends an alert message were 563.5 ms for the conventional method and 484.0 ms for the comparison method. The difference was about 80 ms. The reason for this relatively large difference is that in the conventional method, swatch requires invocation time of curl command.
The time intervals between when the IDS sends an alert message and when a FlowMod command was issued were 17.2 ms for the conventional method and 12.6 ms for the comparison method. The difference was about 5 ms. This implies TCP connection establishment overhead required in the conventional method.
|
IEEE/ICACT20220162 Slide.16
[Big Slide]
[YouTube]