Accelerating snort NIDS using NetFPGA-based Bloom filter

Abstract

In recent years, network intrusion detection systems (NIDS) have faced a serious throughput challenge as a result of the rapid increase of network links to 1 and 10 Gbps rates. Consequently, this calls for NIDS to have wire-speed packet processing and real-time detection of malicious traffic. Snort is the most popular NIDS. Snort is an open source software-based NIDS and runs as a single threaded application. Snort processing and detection capabilities can be limited in networks with 1 and 10 Gbps network links. To overcome such a limitation, we present a design and implementation of two layer NIDS for accelerating Snort detection. The design combines hardware and software components whereby Snort operates as the second line of defense after hardware-assisted inspection of packet headers. In our design, Snort's frequently used rules are offloaded from Snort to a NetFPGA-based hardware layer. The NetFPGA implementation is based on Bloom filter to analyze and filter incoming packets with header fields matching those of frequently used rules. The second line of defense will dynamically offload the most frequently triggered rules to the NetFPGA and will only be executed if deep packet analysis is required for the incoming packet. The experimental results show a significant improvement in the CPU usage and an enormous reduction in packet loss when using Snort with NetFPGA filtering.

The Development Status and Trend of NetFPGA

“…Software DPIs (such as SNORT, Bro, and L7-filter) are detailed described in [29]. For a pattern matching algorithm used in DPI there are two categories: software (KMP [18], BM [20], AC [21] and WM [22]) and hardware (DFA [23], BF [24,25], and CAM). Pattern matching described in [26] is capable of operating at 8Gbps.…”

“…Simultaneously, in paper [43] gave a comparison between them. Furthermore, to prevent degrading network throughput in detecting strings in streaming data, a data structure Bloom Filter [24,25] is used in DPI. The storage needed by Bloom Filter is always dependent of string's length.…”

Modelling and analysis of rule‐based network security middleboxes

“…Acharya et al [17] studied and analysed the functionality of network firewalls to enhance its performance by modifying rule orders dynamically based on the incoming traffic characteristics. Similarly, for Snort IDS, ample recent research work has been reported in the literature [18][19][20][21][22] to enhance the performance of Snort IDS using hardware-assisted techniques such as FPGA, GPU and multi-core processors. The idea in most of these techniques is to offload the computation of Snort to hardware in order to obtain considerable speedup in performance.…”

Incorporating known malware signatures to classify new malware variants in network traffic

“…Software‐based systems can only perform a limited number of operations and could not fulfill wire‐speed detection requirements. However, there are improvements in these systems, specifically the open‐source network intrusion detection system to provide fast detection .…”