Co-evaluation of pattern matching algorithms on IoT devices with embedded GPUs

Abstract

Pattern matching is an important building block for many security applications, including Network Intrusion Detection Systems (NIDS). As NIDS grow in functionality and complexity, the time overhead and energy consumption of pattern matching become a significant consideration that limits the deployability of such systems, especially on resource-constrained devices. On the other hand, the emergence of new computing platforms, such as embedded devices with integrated, general-purpose Graphics Processing Units (GPUs), brings new, interesting challenges and opportunities for algorithm design in this setting: how to make use of new architectural features and how to evaluate their effect on algorithm performance. Up to now, work that focuses on pattern matching for such platforms has been limited to specific algorithms in isolation.In this work, we present a systematic and comprehensive benchmark that allows us to co-evaluate both existing and new pattern matching algorithms on heterogeneous devices equipped with embedded GPUs, suitable for medium-to high-level IoT deployments. We evaluate the algorithms on such a heterogeneous device, in close connection with the architectural features of the platform and provide insights on how these features affect the algorithms' behavior. We find that, in our target embedded platform, GPU-based pattern matching algorithms have competitive performance compared to the CPU and consume half as much energy as the CPU-based variants. Based on these insights, we also propose HYBRID, a new pattern matching approach that efficiently combines techniques from existing approaches and outperforms them by 1.4x, across a range of realistic and synthetic data sets. Our benchmark details the effect of various optimizations, thus providing a path forward

A Survey on Recent Advanced Research of CPS Security

“…However, with the increasing complexity and functionality of NIDS, pattern matching requires more time and energy consumption. Stylianopoulos et al [90] proposed a new pattern matching architecture, which brings new and exciting opportunities for algorithm design, based on embedded GPUs. They evaluated the algorithms on a heterogeneous device and found that GPU-based pattern matching algorithms have competitive performance compared to a CPU and consume half as much energy as the CPU-based variants.…”

“…Typically, rule-based matching is the easiest and fastest way to detect attacks, but it cannot adapt to new attack models. Recent studies have attempted to solve this problem with new approaches, such as behavior-rule specification-based techniques [17], artificial neural networks (ANNs) [89], pattern matching accelerated by GPUs [90], and model-checking [91]. Moreover, they also leveraged fingerprinting techniques to enhance the intrusion detection scheme [11], as minor differences in devices can be used to identify spoofed command responses.…”

On the performance of commodity hardware for low latency and low jitter packet processing

“…They range from operating system interrupts or scheduling and timesharing with other tasks. Moreover, the packet processing application itself needs to be optimized to make best use of the underlying hardware [23] and focus on delivering low latency. Hence, the performance and feasibility of using commodity hardware for latency-critical event-based applications is still an open issue.…”