Edited. Sorry for my "too broad question" previously. Suppose that kinds of attack that I want to generate are these 4 big types of attack, DoS, R2L, U2R and Probe or scan attack by using appropriate attack tools for each attack. Is it possible to detect the attack (labelled) by using only the flow information (layer 1-4) provided by the SDN controller? Even though there are several additional features can be added, but still, based on this flow-related information from SDN controller, especially from ONOS. By detect I mean using anomaly based detection algorithms such as machine-learning or deep-learning algorithms. Thank you.


Currently, I'm working in the IDS (Intrusion Detection System) on the network with SDN controller. My current scheme of the IDS is, detecting attack based on the flow information provided by the SDN controller. I am using ONOS as the SDN controller and simulated network with mininet. In order to do that, I need to define some rules regarding of the attack types that can be detected based on that information. I only need to get which flow is the malicious flow and then I can forward that information to another traditional-based IDS using deep packet inspection (DPI). Thank you for your help.

closed as too broad by Steffen Ullrich, techraf, Rory Alsop Aug 15 '16 at 17:36

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Vincentius - this is way too broad here. Malicious traffic could be anything - what malicious traffic are you planning on generating? Do you know what good traffic will be? Think about blacklist vs whitelist. If you can edit your post appropriately we can reopen. Thanks – Rory Alsop Aug 15 '16 at 17:36

Browse other questions tagged or ask your own question.