Scalable network intrusion detection on virtual SDN environment

We propose a scalable intrusion detection system (IDS) architecture on a software-defined networking (SDN) environment implemented using a virtualization infrastructure called a Kernel-based Virtual Machine (KVM). In this virtual environment, virtual machines running IDSs, the SDN controller, and network attack software are connected with each other through OpenFlow-enabled software switches. This paper focuses on distributed traffic sampling at network switches for malicious traffic inspection. The network topology and the IDS configuration are visualized through a web graphical user interface.