Constraints on autonomous use of standard GPU components for asynchronous observations and intrusion detection

Abstract

The high computational power of graphics processing units (GPU) is used for several purposes nowadays. Factoring integers, computing discrete logarithms, and pattern matching in network intrusion detection systems (IDS) are popular tasks in the field of information security where GPUs are used for acceleration. GPUs are commodity components and are widely available in computer systems which would make them an ideal platform for a wide-spread IDS. We investigate the feasibility to use current GPUs for asynchronous host intrusion detection as proposed in a former work and come to the conclusion that several constraints of GPUs limit the use for concurrent and asynchronous off-CPU processing in host IDSs. GPUs have restrictions in terms of continuity, asynchronism, and unrestricted access to perform this task. We propose an observation mechanism and discuss current constraints on autonomous use of standard GPU components for intrusion detection. Finally, we come to the conclusion that several modifications to graphics cards are necessary to enable our approach.

The cost of observation for intrusion detection: Performance impact of concurrent host observation

“…Besides the bandwidth limitation as such (400Mbit/s), the fact that our signal had to pass two south-and northbridges (target and observer) accounts for the relatively low observation frequency. In our future work, we will overcome the limitations revealed by [8] and use the GPU (up to 16GB/s) for our purposes. By doing so, the measurement frequency will benefit from a higher bandwidth due to the fact that this internal coprocessor is directly connected to the same integrated memory controller the main memory is coupled with.…”

“…That is, the authors pay special attention to concurrent memory accesses, particularly in a NUMA architecture as represented by a standard multi-core (and especially multiprocessor) system. The actual feasibility of a GPU in order to perform host intrusion detection was the subject of [8].…”

“…While [7] is concerned about observations executed by the GPU, similar effects with regard to resource contention and ultimately performance degradation on the host system can be caused by every memory access using DMA. Having in mind the limitations revealed by [8] we thus propose another hardware based approach in this paper: That is, we exploited the ability of the IEEE 1394 technology in order to gain full access to the main memory of a connected computer. In order to make the observation effects as clear as possible, a workload generator produced alterations in a data structure of a pre-defined size.…”