Design and Implementation of FPGA Based High-Performance Intrusion Detection System

Kim, Byoungkoo; Heo, Young-Jun; Oh, Jihyun

doi:10.1007/11760146_106

Cited by 5 publications

(2 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Kim et al [18] have proposed an FPGA-based highperformance IDS to detect different kinds of attacks on high-speed network links. With their implemented proofof-concept, they have claimed that it is possible to offload the pattern matching and heuristic analysis functions of a typical NIDS in FPGA logic.…”

Section: High-performance Idssmentioning

confidence: 99%

Alamut: a high‐performance network intrusion detection system in support of virtualized environments

Sharifi

Salimi

Asadi

2013

Security Comm Networks

View full text Add to dashboard Cite

One of the benefits of virtualization technology is the provision of secure and isolated computing environments on a single physical machine. However, the use of virtual machines for this purpose often degrades the overall system performance that is due to emulation costs, for example, packet filtering on every virtual machine. To allow virtual machines to be favorably used as before for the provision of secure environments but with comparably less performance degradation, we propose a new architecture called Alamut in this paper for restructuring any typical network intrusion detection system (NIDS) to run in a Xen‐based virtual execution environment. In the proposed architecture, primitive mechanisms for implementing the security concerns of typical NIDSs such as signature matching are placed at the kernel level of driver domain (dom0), whereas security policies and management modules are kept in user space of that domain. Separation of mechanisms from policies allows network packets to be verified at the kernel level first hand more efficiently without requiring costly context switches to push them to user space for validation. In addition, system administrators can easily define new policies at user level and determine on which virtual machines these policies should be enforced. A proof‐of‐concept implementation of Alamut has been prototyped on the Xen hypervisor using Bro open‐source NIDS. Experimental results show approximately 3.5‐fold increase in the overall system performance when our prototype is run compared with when Bro is run. Results also show 19% improvement in network throughput. The comparison of Alamut with Snort with the same set of signatures and attacks shows that our prototyped NIDS has lower processor utilization and has captured more packets in heavy network loads. Copyright © 2013 John Wiley & Sons, Ltd.

show abstract

Section: High-performance Idssmentioning

confidence: 99%

Alamut: a high‐performance network intrusion detection system in support of virtualized environments

Sharifi

Salimi

Asadi

2013

Security Comm Networks

View full text Add to dashboard Cite

show abstract

“…Recently, new approaches and solutions addressing the huge amounts of transferred network data and increasing speeds of today's networks were proposed. [9,10,11,12,13,14] aim to accelerate the speed of detection process by using specialized hardware mainly based on FPGA (Field-Programmable Gate Array) technology. Liberouter project [15] introduce the COMBO platform with the FlowMon probe and the IDS probe implemented by FPGA.…”

Section: Introductionmentioning

confidence: 99%

Wild-Inspired Intrusion Detection System Framework for High Speed Networks (f|p) IDS Framework

Sallay

Rouached

Ammar

et al. 2011

International Journal of Information Security and Privacy

View full text Add to dashboard Cite

While the rise of the Internet and the high speed networks made information easier to acquire, faster to exchange and more flexible to share, it also made the cybernetic attacks and crimes easier to perform, more accurate to hit the target victim and more flexible to conceal the crime evidences. Although people are in an unsafe digital environment, they often feel safe. Being aware of this fact and this fiction, the authors draw in this paper a security framework aiming to build real-time security solutions in the very narrow context of high speed networks. This framework is called (f|p) since it is inspired by the elefant self-defense behavior which yields p (22 security tasks for 7 security targets).

show abstract

Programmable embedded system design:A study on sniffer

Tuncer

Tatar

2009

2009 International Conference on Application of Information and Communication Technologies

View full text Add to dashboard Cite

Design and Implementation of FPGA Based High-Performance Intrusion Detection System

Cited by 5 publications

References 1 publication

Alamut: a high‐performance network intrusion detection system in support of virtualized environments

Alamut: a high‐performance network intrusion detection system in support of virtualized environments

Wild-Inspired Intrusion Detection System Framework for High Speed Networks (f|p) IDS Framework

Programmable embedded system design:A study on sniffer

Contact Info

Product

Resources

About