A Hybrid CPU/GPU Pattern-Matching Algorithm for Deep Packet Inspection

Lee, Chun-Liang; Lin, Yi; Chen, Yaw-Chung

doi:10.1371/journal.pone.0139301

Cited by 20 publications

(24 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There is also a drive to design hybrid systems that can leverage the computing power of the CPU and GPU for the purpose of accelerating network intrusion detection [1] [11]. Parallel implementations of clustering algorithms have been used before to detect malicious behaviour on the network and in antivirus software [13].…”

Section: Parallelismmentioning

confidence: 99%

Network Traffic Anomaly Detection Using Shallow Packet Inspection and Parallel K-means Data Clustering

Velea¹,

Ciobanu²,

Mărgărit³

et al. 2017

STUD INFORM CONTROL

View full text Add to dashboard Cite

IT infrastructures around the world are targeted by malicious entities that want to steal data or compromise services. Protection measures for complex computer networks are expensive to deploy and maintain, and often do not offer protection against zero-day exploits. In-depth analysis of incoming and outgoing traffic can be problematic from legal and technical perspectives. The current work explores the possibility of implementing reliable security measures using machine learning algorithms to perform traffic classification. The new framework is mapped on existing parallel hardware and aims to provide a versatile solution for the detection of anomalous behaviour in network traffic through k-means clustering and without performing deep packet inspection. Trace analysis metadata is obtained by exploiting the features available in the pcapng file format. K-means clustering is implemented using multiple parallel APIs and a comparative analysis is presented together with performance considerations.

show abstract

Section: Parallelismmentioning

confidence: 99%

Network Traffic Anomaly Detection Using Shallow Packet Inspection and Parallel K-means Data Clustering

Velea¹,

Ciobanu²,

Mărgărit³

et al. 2017

STUD INFORM CONTROL

View full text Add to dashboard Cite

show abstract

“…Another GPU based algorithm HMPA [33] outperformed CPU only and GPU only implementations as it adopted the hybrid approach. The packet filtering and full pattern matching is performed by CPU and GPU respectively, but overall performance is limited.…”

Section: Pattern Matching Algorithms Over Gpusmentioning

confidence: 99%

GDPI: Signature based Deep Packet Inspection using GPUs

Shoaib¹,

Shamsi²,

Mustafa³

et al. 2017

ijacsa

View full text Add to dashboard Cite

Abstract-Deep Packet Inspection (DPI) is necessitated for many networked application systems in order to prevent from cyber threats. The signature based Network Intrusion and Detection System (NIDS) works on packet inspection and pattern matching mechanisms for the detection of malicious content in network traffic. The rapid growth of high speed networks in data centers demand an efficient high speed packet processing mechanism which is also capable of malicious packets detection. In this paper, we proposed a framework GDPI for efficient packet processing which inspects all incoming packet's payload with known signature patterns, commonly available is Snort. The framework is developed using enhanced GPU programming techniques, such as asynchronous packet processing using streams, minimizing CPU to GPU latency using pinned memory and zero copy, and memory coalescing with shared memory which reduces read operation from global memory of the GPU. The overall performance of GDPI is tested on heterogeneous NVIDIA GPUs, like Tegra Tk1, GTX 780, and Tesla K40 and observed that the highest throughput is achieved with Tesla K40. The design code of GDPI is made available for research community.

show abstract

“…According to literature [13], it described that the CPU performance may be degraded with the computation and memory-intensive operations such as pattern matching algorithm; GPUs processing power may be limited with the data transfer bottleneck via the PCIe channel. Hence, we took these factors into consideration and designed a proper balancing allocation for more improvement; that was our previous work HPMA [8]. The following two aspects were emphasized for this design.…”

Section: Related Workmentioning

confidence: 99%

“…We proposed a hybrid CPU/GPU pattern matching algorithm (HPMA) [8] in our previous study. The HPMA first filtered the incoming packets by the CPU (called as "pre-filtering") to reduce the effect of transfer bottleneck.…”

Section: Introductionmentioning

confidence: 99%

A Capability-Based Hybrid CPU/GPU Pattern Matching Algorithm for Deep Packet Inspection

Lin¹,

Lee²,

Chen³

2016

IJCCE

Self Cite

View full text Add to dashboard Cite

Network applications have been developed quickly during recent years, and communications between these applications involve a large quantity of data transfer through high speed networks. Deep packet inspection (DPI) becomes indispensable to ensure network application-aware security. One of the DPI services is the signature-based network intrusion detection system (NIDS), in which the implementation on software platforms has become a trend due to the advantages of high programmability and low cost. Recently, the graphic processing units (GPU) is commonly used to accelerate the packet processing because of its superior parallel processing power. Since delivering all packets to GPU causes high data transfer latency and consequently restricts the overall performance, our previous study proposed a mechanism, HPMA, to reduce the effect of transfer bottleneck and achieve higher processing speed. In this paper, we introduce an enhancement of HPMA, a capability-based hybrid CPU/GPU pattern matching algorithm (CHPMA). A preliminary experiment shows that the CHPMA not only performs as efficient as the HPMA in most cases, but also obtains higher performance gain than the HPMA under unfavorable conditions.

show abstract

A Hybrid CPU/GPU Pattern-Matching Algorithm for Deep Packet Inspection

Cited by 20 publications

References 25 publications

Network Traffic Anomaly Detection Using Shallow Packet Inspection and Parallel K-means Data Clustering

Network Traffic Anomaly Detection Using Shallow Packet Inspection and Parallel K-means Data Clustering

GDPI: Signature based Deep Packet Inspection using GPUs

A Capability-Based Hybrid CPU/GPU Pattern Matching Algorithm for Deep Packet Inspection

Contact Info

Product

Resources

About