Improving network intrusion detection system performance through quality of service configuration and parallel technology

Abstract

Please cite this article in press as: W. Bul'ajoul et al., Improving network intrusion detection system performance through quality of service configuration and parallel technology, J. Comput. Syst. Sci. (2015), http://dx.

Using Cisco Network Components to Improve NIDPS Performance

“…In previous work [4], we presented experiments that demonstrated that Snort dropped packets when it was deployed in high speed traffic in analysis mode. Packets were dropped or left outstanding when the in-coming speed of traffic is higher than NIDPS processing speed limit.…”

“…We then used parallel technology to increase the throughput rate. This paper presents similar technology to that applied in our previous work [4] but this time it is applied to Snort in detection mode. The QoS configuration in layer 3 Cisco switches provides the capability to differentiate among different classes of traffic and to prioritize the traffic in times of network congestion, according to relative importance.…”

“…The QoS configuration in layer 3 Cisco switches provides the capability to differentiate among different classes of traffic and to prioritize the traffic in times of network congestion, according to relative importance. The research described in this paper uses QoS queue technology to increase monitoring speed rather than reducing or slowing down traffic speed [4]. We used parallel technology to speed up the throughput of NIDPS packets processing to the level of the arrival traffic speeds.…”

“…Despite the existence of a variety of security protection measures, attackers often attempt to render services unavailable to the intended, legitimate users [1,2,3,4]. In general, there are three types of network security techniques: prevention, detection and correction techniques.…”

“…A popular system is the open-source Snort NIDPS. Our previous studies [4,5] have been carried out on the use of a Snort NIDPS in high speed networks. We found that in high speed and high volume environments, the Snort NIDPS drops packets.…”