A method of network workload generation for evaluation of intrusion detection systems in SDN environment

Abstract

Software defined networks create new opportunities for an implementation of the intrusion detection and protection methods. Therefore, special data collections called datasets are necessary for the development, testing and evaluation of such mechanisms. For the SDN environment, there are no prepared datasets that could be used directly to develop IDS methods. These sets contain tuples with features, which represent the activities performed in the IT system. In the presented approach, normal and malicious traffic are generated in the SDN virtual environment. The workload for the dataset is generated in a random manner. The proposed method enables the generation of flows, which can be used for the evaluation of various SDN-based intrusion detection methods.