On the statistical distribution of processing times in network intrusion detection

Cabrera, J.B.D.; Gosar, J.; Lee, W.; Mehra, Raman K.

doi:10.1109/cdc.2004.1428609

Cited by 53 publications

(32 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although many IDPS systems have been proposed, their appropriate configuration and control for effective detection and prevention of attacks has always been far from trivial [5]. Another concern is related to the significant slowing down of system performance when maximum security is applied [3], [14]; hence arises the need to tradeoff between security enforcement levels on one side and the performance and usability of an enterprise information system on the other.…”

Section: Introductionmentioning

confidence: 99%

Policy-Based Security Configuration Management, Application to Intrusion Detection and Prevention

Alsubhi

Aib

Jérôme

et al. 2009

2009 IEEE International Conference on Communications

View full text Add to dashboard Cite

Intrusion Detection and/or Prevention Systems (IDPS) represent an important line of defense against the variety of attacks that can compromise the security and well functioning of an enterprise information system. IDPSes can be network or host-based and can collaborate in order to provide better detections of malicious traffic. Although several IDPS systems have been proposed, their appropriate configuration and control for effective detection and prevention of attacks has always been far from trivial. Another concern is related to the slowing down of system performance when maximum security is applied, hence the need to trade off between security enforcement levels and the performance and usability of an enterprise information system.In this paper we motivate the need for and present a policy-based framework for the configuration and control of the security enforcement mechanisms of an enterprise information system. The approach is based on dynamic adaptation of security measures based on the assessment of system vulnerability and threat prediction and provides several levels of attack containment. As an application, we have implemented a dynamic policy-based adaptation mechanism between the Snort signature-based IDPS and the light weight anomaly-based FireCol IDS. Experiments conducted over the DARPA 2000 and 1999 intrusion detection evaluation datasets show the viability of our framework 1 .

show abstract

Section: Introductionmentioning

confidence: 99%

Policy-Based Security Configuration Management, Application to Intrusion Detection and Prevention

Alsubhi

Aib

Jérôme

et al. 2009

2009 IEEE International Conference on Communications

View full text Add to dashboard Cite

show abstract

“…Signature matching is a highly computationally intensive process, accounting for about 75% of the total CPU processing time of modern NIDSes [2,7]. This overhead arises from the fact that most of the time, every byte of every packet needs to be processed as part of the string searching algorithm that searches for matches among a large set of strings from all signatures that apply for a particular packet.…”

Section: Introductionmentioning

confidence: 99%

Gnort: High Performance Network Intrusion Detection Using Graphics Processors

Vasiliadis

Antonatos

Polychronakis

et al.

Lecture Notes in Computer Science

252

158

View full text Add to dashboard Cite

Abstract. The constant increase in link speeds and number of threats poses challenges to network intrusion detection systems (NIDS), which must cope with higher traffic throughput and perform even more complex per-packet processing. In this paper, we present an intrusion detection system based on the Snort open-source NIDS that exploits the underutilized computational power of modern graphics cards to offload the costly pattern matching operations from the CPU, and thus increase the overall processing throughput. Our prototype system, called Gnort, achieved a maximum traffic processing throughput of 2.3 Gbit/s using synthetic network traces, while when monitoring real traffic using a commodity Ethernet interface, it outperformed unmodified Snort by a factor of two. The results suggest that modern graphics cards can be used effectively to speed up intrusion detection systems, as well as other systems that involve pattern matching operations.

show abstract

“…Pattern matching is a time-consuming task in an NIDS. Studies have indicated that it consumes up to 70% of the system's execution time (3)(4)(5)(6) . Therefore, the pattern matching performance is crucial to an NIDS.…”

Section: Introductionmentioning

confidence: 99%

A Fast and Scalable Multi-Pattern Matching Algorithm for Intrusion Detection Systems

Lee

Huang

Lu³

et al. 2015

The Proceedings of the 2nd International Conference on Industrial Application Engineering 2015

View full text Add to dashboard Cite

In order to protect networks from attacks, network intrusion detection systems (NIDS) have been widely deployed. These devices scan incoming packets to detect malicious content according to the predefined patterns. It is time consuming for NIDS to inspect each packet to check if it contains any patterns. In this paper, we propose a scalable and high-performance pattern matching algorithm. The key idea behind the proposed algorithm is to build a small and adjustable lookup table which can be completely stored in the on-chip memory of a network processor, and reduce the probability of accessing the external memory. Since the latency of one on-chip memory access is far smaller than that of one external memory access, the time required to inspect a packet can be greatly reduced. Simulation results show that the proposed algorithm is significantly better than the compared algorithm in terms of speed and scalability.

show abstract

On the statistical distribution of processing times in network intrusion detection

Cited by 53 publications

References 19 publications

Policy-Based Security Configuration Management, Application to Intrusion Detection and Prevention

Policy-Based Security Configuration Management, Application to Intrusion Detection and Prevention

Gnort: High Performance Network Intrusion Detection Using Graphics Processors

A Fast and Scalable Multi-Pattern Matching Algorithm for Intrusion Detection Systems

Contact Info

Product

Resources

About