Characterizing the performance of network intrusion detection sensors

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 2820, Issue , 2003, Pages 155-172

  Schaelicke, Lambert ^a   Slabach, Thomas ^a   Moore, Branden ^a   Freeland, Curt ^a  

^a University of Notre Dame   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER ARCHITECTURE; COSTS; MERCURY (METAL); NETWORK ARCHITECTURE; PIPELINE PROCESSING SYSTEMS;

DEEP PIPELINES; MICRO ARCHITECTURES; MULTI PROCESSOR ARCHITECTURE; NETWORK INTRUSION DETECTION; NETWORK INTRUSION DETECTION SYSTEMS; PERFORMANCE BOTTLENECKS; PROCESSING COSTS; PROCESSOR PERFORMANCE;

INTRUSION DETECTION;

EID: 35248869269     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-45248-5_9     Document Type: Article

References (24)

1. D. Banks and M. Prudence, "A High-performance Network Architecture for a PA-RISC Workstation", IEEE Journal on Selected Areas in Communications, vol. 11, no. 2, Feb. 1993, pp. 191-202.
2. S. Cheung, R. Crawford, M. Dilger, J. Frank, J. Hoagland, K. Levitt, S. Staniford-Chen, R. Yip, and D. Zerkle, "The Design of GrIDS: A Graph-Based Intrusion Detection System", tech. report CSE-99-02, Computer Science Dept., Univ. of California Davis, Calif., 1999.
3. D. Clark, V. Jacobson, J, Romkey, and M. Salwen, "An Analysis of TCP Processing Overhead", IEEE Communications Magazine, vol. 27, June 1989, pp. 23-29.
4. J. Coit, S. Staniford, J. McAlerney, "Towards Faster String Matching for Intrusion Detection or Exceeding the Speed of Snort", Proc. DARPA Information Survivability Conference and Exposition (DISCEX II '02), IEEE CS Press, Los Alamitos, Calif., 2001, pp. 367-373.
5. R. Danyliw, "ACID: Analysis Console for Intrusion Databases", http://acidlab.sourceforge.net, 2001.
6. S. Edwards, "Vulnerabilities of Network Intrusion Detection Systems: Realizing and Overcoming the Risks. The Case for Flow Mirroring", whitepaper, Top Layer Networks, Inc., 2002.
7. S. Egorov, G. Savchuk, "SNORTRAN: An Optimizing Compiler for Snort Rules", whitepaper, Fidelis Security Systems, Inc.
8. A. Gallatin, J. Chase, and K. Yocum, "Trapeze/IP: TCP/IP at Near-Gigabit Speeds", Proc. 1999 Usenix Technical Conference, Usenix Assoc., Berkeley, Calif., 1999, pp. 109-120.
9. J. Haines, R. Lippmann, D. Fried, J. Korba, and K. Das, "1999 DARPA Intrusion Detection System Evaluation: Design and Procedures", tech. report 1062, MIT Lincoln Laboratory Technical Report, Boston, Mass., 2001.
10. G. Hinton et al, "The Microarchitecture of the Pentium 4 Processor," Intel Technology Journal, Q1 2001.
11. C. Kruegel and T. Toth, "Automatic Rule Clustering for improved, signature-based Intrusion Detection," tech. report, Distributed Systems Group, Technical Univ. Vienna, Austria.
12. C. Kruegel, F. Valeur, G. Vigna and R. Kemmerer, "Stateful Intrusion Detection for High-Speed Networks," Proc. IEEE Symposium Security and Privacy, IEEE Computer Society Press, Calif., 2002.
13. D. Marr et al., "Hyper-Threading Technology Architecture and Microarchitecture", Intel Technology Journal, vol. 6, no. 1, February 2002, pp. 4-15.
14. V. Paxson, "Bro: A System for Detecting Network Intruders in Real-Time," Computer Networks, vol. 31, no. 23-24, 1999, pp. 2435-2463.
15. "Protocol Analysis vs. Pattern Matching," whitepaper, Network ICE, 2000.
16. N. Puketza, K. Zhang, M. Chung, B. Mukherjee, R. Olsson, "A Methodology for Testing Intrusion Detection Systems," IEEE Transactions Software Engineering, vol. 22, no. 10, 1996, pp. 719-729.
17. M. Ranum, "Experiences Benchmarking Intrusion Detection Systems," whitepaper, Network Flight Recorder Security, Inc., http://www.snort.org/docs/Benchmarking-IDS-NFR.pdf
18. M. Roesch, "Snort - Lightweight Intrusion Detection for Networks," Proc. Usenix LISA '99 Conf., November 1999. http://www.snort.org/docs/lisapaper.txt
19. M. Rosenblum, E. Bugnion, S. Herrod, E. Witchel, and A. Gupta, "The Impact of Architectural Trends on Operating System Performance," Proc. 15th ACM Symp. Operating System Principles, ACM Press, New York, N.Y. 1995.
20. R. Sekar, Y. Guang, S, Verma, T. Shanbhag, "A High-Performance Network Intrusion Detection System," Proc. 6th ACM Symp. Computer and Communication Security, ACM Press, New York, N.Y., 1999.
21. "Snort 2.0 - Detection Revisited," whitepaper, Sourcefire Network Security Inc, 2002.
22. Snort Rules for Version 1.9.x as of March 25, 2003. http://www.snort.org/dl/rules/snortrules-stable.tar.gz
23. P. Steenkiste, "A Systematic Approach to Host Interface Design for High-Speed Networks", IEEE Computer, vol. 27, no. 3, March 1994, pp. 47-57.
24. L. McVoy, C. Staelin, "lmbench: Portable Tools for Performance Analysis," Proc. USENIX Ann. Technical Conference, Usenix Assoc., Berkeley, Calif., 1998, pp. 279-294.