An active splitter architecture for intrusion detection and prevention

IEEE Transactions on Dependable and Secure Computing

Volumn 3, Issue 1, 2006, Pages 31-44

  Xinidis, Konstantinos ^a   Charitakis, Ioannis ^a   Antonatos, Spiros ^a,c   Anagnostakis, Kostas G ^b   Markatos, Evangelos P ^a,c,d,e  

^a INSTITUTE OF COMPUTER SCIENCE   (Greece)

^b INSTITUTE FOR INFOCOMM RESEARCH   (Singapore)

^c UNIVERSITY OF CRETE   (Greece)

^d Distributed Computing Systems Laboratory   (South Korea)

^e W3C Office   (Greece)

Author keywords

Intrusion detection and prevention; Network processors; Network level security and protection

Indexed keywords

DATA STORAGE EQUIPMENT; PACKET NETWORKS; PROGRAM PROCESSORS; SECURITY OF DATA; SENSORS;

INTRUSION DETECTION AND PREVENTION; NETWORK PROCESSORS; NETWORK-LEVEL SECURITY AND PROTECTION;

COMPUTER ARCHITECTURE;

EID: 32844469998     PISSN: 15455971     EISSN: None     Source Type: Journal    
DOI: 10.1109/TDSC.2006.6     Document Type: Article

References (39)

1. 2xB: A Domain-Specific String Matching Algorithm for Intrusion Detection," Proc. IFIP Int'l Information Security Conf. (SEC '03), May 2003.
2. S. Antonatos, K.G. Anagnostakis, and E.P. Markatos, "Generating Realistic Workloads for Intrusion Detection Systems," Proc. Fourth ACM SIGSOFT/SIGMETRICS Workshop Software and Performance (WOSP '04), Jan. 2004.
3. S. Antonatos, K.G. Anagnostakis, M. Polychronakis, and E.P. Markatos, "Performance Analysis of Content Matching Intrusion Detection Systems," Proc. Fourth IEEE/IPSJ Symp. Applications and the Internet (SAINT 2004), Jan. 2004.
4. M. Bhattacharyya, M.G. Schultz, E. Eskin, S. Hershkop, and S.J. Stolfo, "MET: An Experimental System for Malicious Email Tracking," Proc. New Security Paradigms Workshop (NSPW), pp. 1-12, Sept. 2002.
5. Z. Cao, Z. Wang, and E.W. Zegura, "Performance of Hashing-Based Schemes for Internet Load Balancing," Proc. IEEE Infocom, pp. 323-341, 2000.
6. I. Charitakis, D. Pnevmatikatos, E.P. Markatos, and K.G. Anagnostakis, "Code Generation for Packet Header Intrusion Analysis on the IXP1200 Network Processor," Proc. Seventh Int'l Workshop Software and Compilers for Embedded Systems (SCOPES '03), Sept. 2003.
7. Cisco Catalyst 6500 Series IDS Module (IDSM-2)}, http://www.cisco.com, 2006.
8. C. Clark, W. Lee, D. Schimmel, D. Contis, M. Kone, and A. Thomas, "A Hardware Platform for Network Intrusion Detection and Prevention," Proc. Third Workshop Network Processors and Applications (NP3), Feb. 2004.
9. C.J. Coit, S. Staniford, and J. McAlerney, "Towards Faster Pattern Matching for Intrusion Detection, or Exceeding the Speed of Snort," Proc. Second DARPA Information Survivability Conf. and Exposition (DISCEX II), June 2002.
10. Consystant Design Technologies, http://www.consystant.com, 2005.
11. M. Fisk and G. Vargheseau, "An Analysis of Fast String Matching Applied to Content-Based Forwarding and Intrusion Detection," Technical Report CS2001-0670 (updated version), Univ. of California at San Diego, 2002.
12. G. Goldszmidt and G. Hunt, "Scaling Internet Services by Dynamic Allocation of Connections," Proc. Sixth IFIP/IEEE Int'l Symp. Intergrated Network Management, pp. 171-184, May 1999.
13. M. Handley, V. Paxson, and C. Kreibich, "Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics," Proc. 10th USENIX Security Symp., 2001.
14. Intel Corporation, "Intel IXP1200 Network Processor,"white paper, 2000, http://developer.intel.com.
15. Internet Security Systems Inc., http://www.iss.net, 2006.
16. T. Karagiannis, A. Broido, M. Faloutsos, and K. Claffy, "Transport Layer Identification of P2P Traffic," Proc. Internet Measurement Conf. (IMC), Oct. 2004.
17. C. Kruegel, F. Valeur, G. Vigna, and R. Kemmerer, "Stateful Intrusion Detection for High-Speed Networks," Proc. IEEE Symp. Security and Privacy, pp. 285-294, May 2002.
18. C. Kruegel and G. Vigna, "Anomaly Detection of Web-Based Attacks," Proc. 10th ACM Conf. Computer and Comm. Security (CCS), pp. 251-261, Oct. 2003.
19. W. Lee, S.J. Stolfo, P.K. Chan, E. Eskin, W. Fan, M. Miller, S. Hershkop, and J. Zhang, "Real-Time Data Mining Based Intrusion Detection," Proc. DISCEX II, June 2001.
20. S. Li, J. Torresen, and O. Soraasen, "Exploiting Reconfigurable Hardware for Network Security," Proc. IEEE Symp. Field-Programmable Custom Computing Machines (FCCM '03), Apr. 2003.
21. R. Lippmann, J.W. Haines, D.J. Fried, J. Korba, and K. Das, "The 1999 DARPA Off-Line Intrusion Detection Evaluation," Computer Networks, vol. 34, no. 4, pp. 579-595, Oct. 2000.
22. E.P. Markatos, D.N. Pnevmatikatos, M.D. Flouris, and M.G.H. Katevenis, "Web-Conscious Storage Management for Web Proxies," IEEE/ACM Trans. Networks, vol. 10, no. 6, pp. 735-748, 2002.
23. M. Necker, D. Contis, and D. Schimmel, "TCP-Stream Reassembly and State Tracking in Hardware," Proc. IEEE Symp. Field-Programmable Custom Computing Machines (FCCM '02), Apr. 2002.
24. NetScreen Technologies, http://www.netscreen.com, 2005.
25. Network Associates, Inc., http://www.networkassociates.com, 2005.
26. NLANR, "MRA Traffic Archive," Sept. 2002, http://pma.nlanr. net/PMA/Sites/MRA.html.
27. V. Paxson, "Bro: A System for Detecting Network Intruders in Real-Time," Proc. Seventh USENIX Security Symp., Jan. 1998.
28. Peapod, "Radware Linkproof,"http://www.peapod.co.uk/ radware_linkproof.htm, 2006.
29. M. Roesch, "Snort: Lightweight Intrusion Detection for Networks," Proc. Second USENIX Symp. Internet Technologies and Systems, Nov. 1999, http://www.snort.org.
30. M. Schiffman, "The Million Packet March," http://www.pack- etfactory.net/Projects/Libnet/, 2006.
31. D.V. Schuehler, J. Moscola, and J.W. Lockwood, "Architecture for a Hardware-Based, TCP/IP Content-Processing System," IEEE Micro, vol. 24, no. 1, pp. 62-69, 2004.
32. Sourcefire, Snort 2.0 - Detection Revisited, Oct. 2002, http://www.snort.org/docs/Snort_20_v4.pdf.
33. Intel Xeon Processor MP Specification Update, Oct. 2005, http://download.intel.com/design/Xeon/specupdt/29074135.pdf.
34. TippingPoint Technolgies Inc., http://www.tippingpoint.com, 2005.
35. Top Layer Networks, http://www.toplayer.com, 2006.
36. TopLayer, "IDS Load Balancer,"http://www.toplayer.com/, 2006.
37. T. Toth and C. Kruegel, "Accurate Buffer Overflow Detection via Abstract Payload Execution," Proc. Fifth Symp. Recent Advances in Intrusion Detection (RAID), Oct. 2002.
38. T. Toth and C. Kruegel, "Connection-History Based Anomaly Detection," Proc. IEEE Workshop Information Assurance and Security, June 2002.
39. K. Wang and S.J. Stolfo, "Anomalous Payload-Based Network Intrusion Detection," Proc. Seventh Int'l Symp. Recent Advanced in Intrusion Detection (RAID), pp. 201-222, Sept. 2004.