Advertisement

Parallel Optimization Technology for Backbone Network Intrusion Detection System

  • Xiaojuan Sun
  • Xinliang Zhou
  • Ninghui Sun
  • Mingyu Chen
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3802)

Abstract

Network intrusion detection system (NIDS) is an active field of research. With the rapidly increasing network speed, the capability of the NIDS sensors limits the ability of the system. The problem is more serious for the backbone network intrusion detection system (BNIDS). In this paper, we apply parallel optimization technologies to BNIDS using 4-way SMP server as the target system. After analyzing and testing the defects of the existed system in common use, the optimization policies of using fine-grained schedule mechanism at connection level and avoiding lock operations in thread synchronization are issued for the improved system. Through performance evaluation, the improved system shows more than 25 percent improvement in CPU utilization rate compared with the existed system, and good scalability.

Keywords

Intrusion Detection High Performance Computer Drop Packet Rate Master Thread Network Intrusion Detection System 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Christopher, K., Fredrik, V., Giovanni, V., Richard, K.: Stateful Intrusion Detection for High-Speed Networks. In: Proceedings of the IEEE Symposium on Security and Privacy, Los Alamitos, Calif. (2002)Google Scholar
  2. 2.
    Simon, E.: Vulnerabilities of Network Intrusion Detection Systems: Realizing and Overcomign the Risks – The Case for Flow Mirroring. Top Layer Networks (2002)Google Scholar
  3. 3.
    Lambert, S., Kyle, W., Curt, F.: SPANIDS: A Scalable Network Intrusion Detection Loadbalancer. In: Conf. Computing Frontiers, Ischia, Italy, pp. 315–322 (2005)Google Scholar
  4. 4.
    IDP 1000/1100. Juniper Networks, http://www.juniper.net/products/
  5. 5.
  6. 6.
    Top Layer Networks, http://www.toplayer.com/
  7. 7.
    Xiaoling, Z., Jizhou, S., Shishi, L., Zunce, W.: A Parallel Algorithm for Protocol Reassembling. In: IEEE Canadian Conference on Electrical and Computer Engineering. Montreal (2003)Google Scholar
  8. 8.
    Spyros, A., Kostas, G.A., Evangelos, P.M., Michalis, P.: Performance Analysis of Content Matching Intrusion Detection Systems. In: Proceedings of the IEEE/IPSJ Symposium on Applications and the Internet. Tokyo (2004)Google Scholar
  9. 9.
    Rong-Tai, L., Nen-Fu, H., Chin-Hao, C., Chia-Nan, K.: A Fast String-matching Algorithm for Network Processor-based Intrusion Detection System. ACM Transactions on Embedded Computing System 3(3) (2004)Google Scholar
  10. 10.
    Vtune Performance Analyzer, http://www.intel.com/software/products/
  11. 11.
  12. 12.
    SPECWeb99 Benchmark, http://www.spec.org/osg/web99/
  13. 13.
    David, M., Tai, J.: Httperf: A Tool for Measuring Web Server Performance. In: Proceedings of the SIGMETRICS Workshop on Internet Server Performance. Madison (1998)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2005

Authors and Affiliations

  • Xiaojuan Sun
    • 1
  • Xinliang Zhou
    • 1
  • Ninghui Sun
    • 1
  • Mingyu Chen
    • 1
  1. 1.National Research Center for Intelligent Computing Systems, Institute of Computing TechnologyChinese Academy of SciencesBeijingChina

Personalised recommendations