Quick Blocking of IDS/SDN Cooperative FireWall Systems Through Rule Partitioning and Parallelization of IDS in a Single Computer

IDS/SDN cooperative firewall systems have attracted attention in recent years due to their flexible control of routes and changing configurations. Traffic between clients and servers is relayed by SDN switches, which mirror traffic to IDS hosts. The IDS host detects attacks and notifies the SDN switch of attack detection to block malicious traffic. The more diverse the attacks, the greater the number of detection rules required, and processing a large number of rules causes a high load on the IDS, resulting in an increase of blocking time of attacks. In this paper, we approach partitioning IDS rules, load balancing by using multiple IDSs, and executing it on a single computer can reduce blocking time compared with existing systems.