METHOD AND APPARATUS FOR EFFECTIVE INTRUSION DETECTION IN INTERNAL NETWORK

摘要

According to an embodiment of the present invention, a method for detecting an intrusion comprises: a step of periodically receiving a flow from a software defined network (SDN) switch in an SDN environment and sensing an attack to receive flow statistics; a step of transmitting flow information to a flow-based first IDS which is operated using an SDN application by receiving the flow statistics, and detecting an intrusion based on the flow information; and a step of receiving a packet including an IP address and a port number from the flow information to transmit the packet to a second IDS, and redetecting an intrusion based on information about the packet.