On improving performance of network intrusion detection systems by efficient packet capturing

IEEE Symposium Record on Network Operations and Management Symposium

Volumn , Issue , 2006, Pages

  Biswas, Amitava ^a   Sinha, Purnendu ^a  

^a Dept of Electrical and Computer Engineering   (Canada)

Author keywords

High bandwidth packet capture; Performance improvement of network intrusion detection system

Indexed keywords

COMPUTER OPERATING SYSTEMS; DISTRIBUTED COMPUTER SYSTEMS; NETWORK SECURITY; PACKET NETWORKS; REAL TIME SYSTEMS; SENSORS;

HIGH BANDWIDTH PACKET CAPTURE; NETWORK INTRUSION DETECTION SYSTEM (NIDS); SPACE NETWORK INTERFACE;

INTRUSION DETECTION;

EID: 42749099456     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/noms.2006.1687642     Document Type: Conference Paper

References (16)

1. V. Paxson , " Bro: A System for Detecting Network Intruders in Real-Time," Proce. of 7th USENIX Security Symposium, San Antonio, Texas, 1998. http://www.ece.cmu.edu/~adrian/731-sp04/readings/paxson99-bro.pdf
2. C.J. Coit, S. Staniford, J. McAlerney, "Towards faster string matching for intrusion detection or exceeding the speed of Snort," Proce. of DARPA Information Survivability Conference & Exposition II, 2001. DISCEX '01. Vol. 1, pp. 367 - 373, June 2001.
3. C. Kruegel and T. Toth, "Automatic Rule Clustering for improved, signature-based Intrusion Detection, " tech. report, Distributed Systems Group, Technical Univ. Vienna, Austria.
4. Snort website, http://www.snort.org
5. Libpcap source code, http://www.tcpdump.org
6. C. Kruegel, F. Valeur, G. Vigna and R. Kemmerer, "Stateful intrusion detection for high-speed networks," in Proce. of 2002 IEEE Symposium on Security and Privacy, pp. 285-293, 2002.
7. G. Judge, A Verus, "FPGA Architecture Ups Intrusion Detection Performance," Sept 2003. http://www.commsdesign.com/printableArticle/? articleID=16502099
8. th International System Administration and Network Engineering Conference, Amsterdam, Netherlands, Sept 2004.
9. L. Schaelicke, K. Wheeler and C. Freeland, "SPANIDS: A scalable network intrusion detection load balancer," in Proce. of the 2nd Conf. on Computing frontiers, Ischia, Italy, pp. 315-322, May 2005.
10. R. Sekar, Y. Guang, S. Verma, T. Shanbhag, "A high-performance network intrusion detection system," Proce. of the 6th ACM conference on Computer and communications security, Nov. 1999. http://dbvis.fmi.unikonstanz. de/members/panse/seminar_ws0203/pdf/sekar99highperformance.pdf
11. S.A Yemini, S. Kliger, E. Mozes, Y. Yemini and D. Ohsie, "High speed and robust event correlation," Communications Magazine, IEEE, Vol.34(5), pp. 82 - 90, May 1996.
12. I. Charitakis, K. Anagnostakis, and E. Markatos, "An active traffic splitter architecture for intrusion detection," Proce. of the 11th IEEE/ACM International Symposium on Modeling, Analysis and Simulation of Computer Telecommunications Systems, pp. 238 - 241, Oct. 2003.
13. N. Desai, "Optimizing NIDS Performance". http://online. securityfocus.com/infocus/1589
14. B.Haagdorens, T. Vermeiren and M. Goossens, "Improving the performance of Signature based Network Intrusion Detection Sensors by Multi-threading," http://dasan.sejong.ac.kr/~wisa04/ppt/5A1.ppt
15. Salim, J. H. and Olsson, R., "Beyond softnet," Proce. of the 5th Annual Linux Showcase & Conference, Oakland, CA, pp. 165-172, 2001.
16. A. Biswas, P Sinha, "A high performance platform for intrusion detection sensors," Proce. of the 4th IASTED International Conference on Communications, Internet and Information Technology, Cambridge, MA, 2005.