SnortFlow: A OpenFlow-Based Intrusion Prevention System in Cloud Environment

TLDR

Security is a top concern in cloud computing, where hybrid physical and virtual networks make secure networking challenging, and IDS/IPS are widely deployed to enhance cloud security. This study investigates SnortFlow, an OpenFlow‑based IPS that detects intrusions and deploys countermeasures by reconfiguring the cloud network on‑the‑fly. SnortFlow integrates Snort with OpenFlow to dynamically reconfigure the cloud networking system for intrusion detection and prevention. Evaluation results demonstrate SnortFlow’s feasibility and offer guidance for future work.

Abstract

Security has been one of the top concerns in clouds. It is challenging to construct a secure networking environment in clouds because the cloud is usually a hybrid networking system containing both physical and virtually overlaid networks. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) have been widely deployed to manipulate cloud security, with the latter providing additional prevention capabilities. This paper investigates into an OpenFlow and Snort based IPS called "SnortFlow", in which it enables the cloud system to detect intrusions and deploy countermeasures by reconfiguring the cloud networking system on-the-fly. The evaluation results demonstrate the feasibility of SnortFlow and provide the guidance for the future work.