Design, Simulation and Deployment of a Snort-Based Intrusion Detection and Prevention System (IDPS) for Securing the ICT Infrastructure of Kebbi State Polytechnic, Dakingari Using Software Defined Networking (SDN)

Author

Shamsu Sani, Salihu Alhassan, Sulaiman Umar S. Noma, Sadiq Abubakar Zagga

Abstract

 The increasing dependence of tertiary institutions on Information and Communication Technology (ICT) infrastructure has expanded the attack surface of institutional networks and increased the potential impact of network-based cyberattacks. Software Defined Networking (SDN) provides programmability, centralized control and a global view of network resources, but the separation of the control and data planes also introduces security risks, particularly against denial-of-service and distributed denial-of-service (DDoS) attacks. This study presents the design, simulation and prototype deployment of a Snort-based Intrusion Detection and Prevention System (IDPS) integrated with an SDN environment for securing the ICT infrastructure of Kebbi State Polytechnic, Dakingari. The work transforms an earlier Snort-based SDN intrusion detection study into an institution-oriented security architecture. An experimental and prototype-based research design was adopted. A virtual testbed was implemented using VirtualBox, Ubuntu Linux, OpenDaylight, Mininet, Open vSwitch, Snort, Kali Linux, Metasploitable2 and Wireshark. A programmable SDN topology was created and subjected to normal traffic and selected DDoS attack scenarios, including SYN flood, ping flood, ping of death and HTTP/SYN flooding. Snort was configured with local rules and traffic mirroring to inspect network traffic and generate alerts. The experimental observations show that the integrated environment successfully exposed abnormal traffic patterns and generated Snort alerts for the selected attack scenarios; in the documented ping flood and ping-of-death experiments, the attacked destination recorded zero packets received after the attack was stopped, corresponding to complete packet loss during those controlled observations. The study demonstrates the feasibility of combining SDN programmability with Snort-based network intrusion monitoring as a cost-effective security model for tertiary-institution networks. However, the reported experiments constitute a controlled virtual/prototype deployment rather than a live production deployment in the Polytechnic ICT Centre. Future work should therefore validate the architecture on live institutional traffic, quantify detection accuracy and false-positive rates, and extend the system with automated SDN-based flow blocking and adaptive or machine-learning-assisted detection.

Keywords

Software Defined Networking, Snort, Intrusion Detection and Prevention System, DDoS, Network Security, Mininet, OpenDaylight, Kebbi State Polytechnic.

Full Text:

Download Paper PDF

References

Abubakar, A., & Pranggono, B. (2017). Machine learning based intrusion detection system for Software Defined Networks.

Ahmad, S., & Hussain Mir, A. (2022). SDN interfaces: Protocols, taxonomy and challenges. International Journal of Wireless and Microwave Technologies, 12(2), 11–32. https://doi.org/10.5815/ijwmt.2022.02.02

Ajaeiya, G. A., & Chehab, N. A. I. H. E. A. K. A. (2017). Flow-based intrusion detection system for SDN. Journal of Basic and Applied Scientific Research, 3(6), 850–859.

Ajiya Ahmad, A., Boukari, S., Musa Bello, A., & Aliyu Muhammad, M. (2021). A survey of intrusion detection techniques on Software Defined Networking (SDN). International Journal of Innovative Science and Research Technology, 6(8).

Alashhab, A. A., Zahid, M. S. M., Azim, M. A., Daha, M. Y., Isyaku, B., & Ali, S. (2022). A survey of low rate DDoS detection techniques based on machine learning in Software-Defined Networks. Symmetry, 14(8). https://doi.org/10.3390/sym14081563

Alkhalil, Z., Hewage, C., Nawaf, L., & Khan, I. (2021). Phishing attacks: A recent comprehensive study and a new anatomy. Frontiers in Computer Science, 3. https://doi.org/10.3389/fcomp.2021.563060

Badotra, S., & Panda, S. N. (2020). SNORT based early DDoS detection system using OpenDaylight and Open Networking Operating System in software defined networking. Cluster Computing. https://doi.org/10.1007/s10586-020-03133-y

Bhosale, K. S., Nenova, M., & Iliev, G. (2020). Intrusion detection in communication networks using different classifiers. In Techno-Societal 2018, 19–28. https://doi.org/10.1007/978-3-030-16962-6_3

Casula, M., Rangarajan, N., & Shields, P. (2021). The potential of working hypotheses for deductive exploratory research. Quality & Quantity, 55(5), 1703–1725. https://doi.org/10.1007/s11135-020-01072-9

Dantas Silva, F. S., Silva, E., Neto, E. P., Lemos, M., Venancio Neto, A. J., & Esposito, F. (2020). A taxonomy of DDoS attack mitigation approaches featured by SDN technologies in IoT scenarios. Sensors, 20(11). https://doi.org/10.3390/s20113078

Dong, S., Abbas, K., & Jain, R. (2019). A survey on distributed denial of service (DDoS) attacks in SDN and cloud computing environments. IEEE Access, 7, 80813–80828. https://doi.org/10.1109/ACCESS.2019.2922196

Farooq, M. S., Riaz, S., & Alvi, A. (2023). Security and privacy issues in Software-Defined Networking (SDN): A systematic literature review. Electronics, 12(14). https://doi.org/10.3390/electronics12143077

Hande, Y., & Muddana, A. (2020). A survey on intrusion detection system for software defined networks (SDN). International Journal of Business Data Communications and Networking, 16(1), 28–47. https://doi.org/10.4018/IJBDCN.2020010103

Iriananda, S. W., et al. (2019). Intelligent distributed privacy-preserving DDoS attack detection using software defined networks.

Jonker, J., & Pennink, B. W. (2010). The essence of research methodology.

Kaur Chahal, J., Bhandari, A., & Behal, S. (2019). Distributed denial of service attacks: A threat or challenge. New Review of Information Networking, 24(1), 31–103. https://doi.org/10.1080/13614576.2019.1611468

Mustafa, A. S., Mkpanam, D., & Abdullahi, A. (2018). Security in Software Defined Networks (SDN): Challenges and research opportunities for Nigeria. International Journal of Computer Applications Technology and Research, 7(8), 297–300. https://doi.org/10.7753/IJCATR0708.1002

Olanrewaju, R. F., Islam Khan, B. U., Najeeb, A. R., Ku Zahir, K. N. A., & Hussain, S. (2018). Snort-based smart and swift intrusion detection system. Indian Journal of Science and Technology, 11(4), 1–9. https://doi.org/10.17485/ijst/2018/v11i4/120917

Pradhan, A., & Mathew, R. (2020). Solutions to vulnerabilities and threats in Software Defined Networking (SDN). Procedia Computer Science, 171, 2581–2589. https://doi.org/10.1016/j.procs.2020.04.280

Ribamar, A. de, Ribeiro, L., Yves, R., Santos, C., Clayton, A., & Nascimento, A. (2021). Anomaly detection technique for intrusion detection in SDN environment using continuous data stream machine learning algorithms.

Riskhan, B., Safuan, H. A. J., Hussain, K., Elnour, A. A. H., Abdelmaboud, A., Khan, F., & Kundi, M. (2023). An adaptive distributed denial of service attack prevention technique in a distributed environment. Sensors, 23(14). https://doi.org/10.3390/s23146574

Singh. (2020). UC Berkeley electronic theses and dissertations.

Sudar, K. M., & Deepalakshmi, P. (2020). Comparative study on IDS using machine learning approaches for software defined networks. International Journal of Intelligent Enterprise, 7(1–3), 15–27. https://doi.org/10.1504/IJIE.2020.104642

Sultana, N., Chilamkurti, N., Peng, W., & Alhadad, R. (2018). Survey on SDN based network intrusion detection system using machine learning approaches.

Yin, D., Zhang, L., & Yang, K. (2018). A DDoS attack detection and mitigation with Software-Defined Internet of Things framework. IEEE Access, 6, 24694–24705. https://doi.org/10.1109/ACCESS.2018.2831284

 

 

 

Share your valuable work from Social Media Buttons