An Efficient Hash-Based Load Balancing Scheme to Support Parallel NIDS

Abstract. Flow based monitoring is currently a standard approach suitable for large networks of ISP size. The main advantage of flow processing is a smaller amount of data due to aggregation. There are many reasons (such as huge volume of transferred data, attacks represented by many flow records) to develop scalable systems that can process flow data in parallel. This paper deals with splitting a stream of flow data in order to perform parallel anomaly detection on distributed computational nodes. Flow data distribution is focused not only on uniformity but mainly on successful detection. The results of an experimental analysis show that the proposed approach does not break important semantic relations between individual flow records and therefore it preserves detection results. All experiments were performed using real data traces from Czech National Education and Research Network.

show abstract

“…Kim et al in [6] compare static and dynamic hash-based load balancing schemes and propose dynamic (i.e. adaptive) load-balancing scheme for NIDS.…”

Section: Related Workmentioning

confidence: 99%

Making Flow-Based Security Detection Parallel

Švepeš¹,

Čejka

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…4 Multiprocessing techniques have been employed to increase the throughput of the sensor and reduce packet loss. 8 In addition to this Song et al point to the software crash as yet another cause of packet loss. 9 Wei et al consider the problem of packet loss in an IPv6 environment.…”

Section: Sensormentioning

confidence: 99%

A Theoretical Exploration of the Impact of Packet Loss on Network Intrusion Detection

Smith¹,

Hammell²,

Parker³

et al. 2016

IJNDC

View full text Add to dashboard Cite

In this paper we review the problem of packet loss as it pertains to Network Intrusion Detection, seeking to answer two fundamental research questions which are stepping stones towards building a model that can be used to predict the rate of alert loss based upon the rate of packet loss. The first question deals with how the packet loss rate affects the sensor alert rate, and the second considers how the network traffic composition affects the results of the first question. Potential places where packet loss may occur are examined by dividing the problem into network, host, and sensor based packet loss. We posit theories about how packet loss may present itself and develop the Packet Dropper that induces packet loss into a dataset. Drop rates ranging from 0% to 100% are applied to four different datasets and the resulting abridged datasets are analyzed with Snort to collect alert loss rate. Conclusions are drawn about the importance of the distribution of packet loss and the effect of the network traffic composition.

show abstract

“…Significant improvements in the packet loss rate could also be achieved by pruning the sensor rule set [4]. Multi-processing techniques have been employed to increase the throughput of the sensor and reduce packet loss [8]. In addition to this Song et al point to the software crash as yet another cause of packet loss [9].…”

Section: Sensormentioning

confidence: 99%

“…Gilbert [11] provides us with the following formula to calculate the error probability of the previous model letting d be the drop rate and P=P(Bad state|Good State) and Q = P(Good state|Bad state). When h represents the probability that the a packet will transmitted in state B we have: (7) Solving for P we get: (8) To allow for the full domain yet ensure that the value of P stays within the range for 0 to 1 we need to set h = 0, and Q = 0.05; The value of P is undefined when d = 1; therefore, we will make provisions for this condition.…”

Section: ) a Two State Channel Modelmentioning

confidence: 99%