Efficient Software Packet Processing on Heterogeneous and Asymmetric Hardware Architectures

Papadogiannaki, Eva; Koromilas, Lazaros; Vasiliadis, Giorgos; Ioannidis, Sotiris

doi:10.1109/tnet.2016.2642338

Cited by 17 publications

(13 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We implement the pattern matching engine of our system as an OpenCL compute kernel. Unlike other relevant works that follow a packet-per-thread processing approach [ 9 , 10 , 18 , 19 ], we follow a flow-per-thread approach. This means that each thread reads at least one network flow from the execution batch and then performs the processing ( Figure 6 ).…”

Section: Intrusion Detection Enginementioning

confidence: 99%

“…The benefits for such an implementation is the high processing throughput, as well as the low cost of powerful commodity high-end off-the-shelf GPUs (in contrast to expensive server setups). Since GPUs offer stream processing, real-time traffic inspection can be achieved [ 8 , 9 , 10 , 11 , 12 ]. Fast metadata matching can enhance the implementation of numerous applications tailored for encrypted networks, such as traffic monitoring and firewalls.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Acceleration of Intrusion Detection in Encrypted Network Traffic Using Heterogeneous Hardware

Papadogiannaki

Ioannidis

2021

Sensors

Self Cite

View full text Add to dashboard Cite

More than 75% of Internet traffic is now encrypted, and this percentage is constantly increasing. The majority of communications are secured using common encryption protocols such as SSL/TLS and IPsec to ensure security and protect the privacy of Internet users. However, encryption can be exploited to hide malicious activities, camouflaged into normal network traffic. Traditionally, network traffic inspection is based on techniques like deep packet inspection (DPI). Common applications for DPI include but are not limited to firewalls, intrusion detection and prevention systems, L7 filtering, and packet forwarding. With the widespread adoption of network encryption though, DPI tools that rely on packet payload content are becoming less effective, demanding the development of more sophisticated techniques in order to adapt to current network encryption trends. In this work, we present HeaderHunter, a fast signature-based intrusion detection system even for encrypted network traffic. We generate signatures using only network packet metadata extracted from packet headers. In addition, we examine the processing acceleration of the intrusion detection engine using different heterogeneous hardware architectures.

show abstract

Section: Intrusion Detection Enginementioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Acceleration of Intrusion Detection in Encrypted Network Traffic Using Heterogeneous Hardware

Papadogiannaki

Ioannidis

2021

Sensors

Self Cite

View full text Add to dashboard Cite

show abstract

“…Jahmsed et al [45] present Kargus, a custom NIDS that uses multiple GPUs and CPU cores. Papadogiannaki et al [46] present a similar system and enhance it with a scheduler that dynamically decides the placement of packet processing tasks.…”

Section: Other Architecturesmentioning

confidence: 99%

Multiple pattern matching for network security applications: Acceleration through vectorization

Stylianopoulos

Almgren

Papatriantafilou

2020

Journal of Parallel and Distributed Computing

View full text Add to dashboard Cite

As both new network attacks emerge and network traffic increases in volume, the need to perform network traffic inspection at high rates is ever increasing. The core of many security applications that inspect network traffic (such as Network Intrusion Detection) is pattern matching. At the same time, pattern matching is a major performance bottleneck for those applications: indeed, it is shown to contribute to more than 70% of the total running time of Intrusion Detection Systems. Although numerous efficient approaches to this problem have been proposed on custom hardware, it is challenging for pattern matching algorithms to gain benefit from the advances in commodity hardware. This becomes even more relevant with the adoption of Network Function Virtualization, that moves network services, such as Network Intrusion Detection, to the cloud where scaling on commodity hardware is key for performance. In this paper, we tackle the problem of pattern matching and show how to leverage the architecture features found in commodity platforms. We present efficient algorithmic designs that achieve good cache locality and make use of modern vectorization techniques to utilize data parallelism within each core. We first identify properties of pattern matching that make it fit for vector-$ Preliminary results of this work were presented the 46th International Conference on Parallel Processing (ICPP) 2017 [1].

show abstract

“…Jamshed et al [7] present Kargus, a similar, highly parallel system based on their own, custom IDS. Recently, Papadogiannaki et al [13] presented a scheduler that dynamically distributes the packet processing workload across a system with heterogeneous hardware resources (including both discrete and integrated GPUs). Finally, Go et al [4] also show that integrated GPUs are a cost-effective alternative for packet processing.…”

Section: Nids On Gpusmentioning

confidence: 99%

CLort: High Throughput and Low Energy Network Intrusion Detection on IoT Devices with Embedded GPUs

et al. 2018

View full text Add to dashboard Cite

While IoT is becoming widespread, cyber security of its devices is still a limiting factor where recent attacks (e.g., the Mirai botnet) underline the need for countermeasures. One commonly-used security mechanism is a Network Intrusion Detection System (NIDS), but the processing need of NIDS has been a significant bottleneck for large dedicated machines, and a show-stopper for resource-constrained IoT devices. However, the topologies of IoT are evolving, adding intermediate nodes between the weak devices on the edges and the powerful cloud in the center. Also, the hardware of the devices is maturing, with new CPU instruction sets, caches as well as co-processors. As an example, modern single board computers, such as the Odroid XU4, come with integrated Graphics Processing Units (GPUs) that support general purpose computing. Even though using all available hardware efficiently is still an open issue, it has the promise to run NIDS more efficiently.In this work we introduce CLort, an extension to the well-known NIDS Snort that a) is designed for IoT devices b) alleviates the burden of pattern matching for intrusion detection by offloading it to the GPU. We thoroughly explain how our design is used as part of the latest release of Snort and suggest various optimizations to enable processing on the GPU. We evaluate CLort in regards to throughput, packet drops in Snort, and power consumption using publicly available traffic traces. CLort achieves up to 52% faster processing throughput than its CPU counterpart. CLort can also analyze up to 12% more packets than its CPU counterpart when sniffing a network. Finally, the experimental evaluation shows that CLort consumes up to 32% less energy than the CPU counterpart, an important consideration for IoT devices.

show abstract

Efficient Software Packet Processing on Heterogeneous and Asymmetric Hardware Architectures

Cited by 17 publications

References 17 publications

Acceleration of Intrusion Detection in Encrypted Network Traffic Using Heterogeneous Hardware

Acceleration of Intrusion Detection in Encrypted Network Traffic Using Heterogeneous Hardware

Multiple pattern matching for network security applications: Acceleration through vectorization

CLort: High Throughput and Low Energy Network Intrusion Detection on IoT Devices with Embedded GPUs

Contact Info

Product

Resources

About