Improving Snort performance under Linux

IET Communications

Volumn 3, Issue 12, 2009, Pages 1883-1895

  Salah, K ^a   Kahtani, A ^a  

^a KING FAHD UNIVERSITY OF PETROLEUM AND MINERALS   (Saudi Arabia)

Author keywords

[No Author keywords available]

Indexed keywords

CONFIGURATION PARAMETERS; DOMINATING FACTORS; INCOMING TRAFFIC; INTRUSION PREVENTION SYSTEMS; MALICIOUS PACKETS; MALICIOUS TRAFFIC; NETWORK INTRUSION DETECTION SYSTEMS; OPEN-SOURCE; PACKET INSPECTION; PACKET RECEPTION; QUEUING MODELS; SOFTWARE COMPONENT; TRAFFIC LOADS;

COMPUTER CRIME; COMPUTER OPERATING SYSTEMS; INTERNET; NETWORK SECURITY; PACKET LOSS; SOFTWARE ARCHITECTURE;

INTRUSION DETECTION;

EID: 70450211167     PISSN: 17518628     EISSN: None     Source Type: Journal    
DOI: 10.1049/iet-com.2009.0114     Document Type: Article

References (38)

1. Snort: http://www.snort.org/
2. Alder, R., Babbin, J., Doxtater, A., Foster, J.C., Kohlenberg, T., and Rash, M.: ' Snort 2.1 intrusion detection ', 2nd (Syngress, 2004)
3. Cox, K.J., and Gerg, C.: ' Managing security with snort and ids tools ', (O'Reilly Press, 2004)
4. Abbas, S.: ' Introducing multi-threaded solution to enhance the efficiency of snort ', 2002, MS, Department of Computer Science, Florida State University
5. Vermeiren, T., Borghs, E., and Haaodorens, B.: ' Evaluation of software techniques for parallel packet processing on multi-core processors ', Proc. First IEEE Consumer Communications and Networking Conf., CCNC 2004, Las Vegas, NV, January, 2004, p. 645-647
6. Turnbull, J.: ' Improving Snort performance with Barnyard ', EnterpriseLinux.Com Mag., 2007
7. Haagdorens, B., Vermeiren, T., and Goossens, M.: ' Improving the performance of signature-based network intrusion detection sensors by multi-threading ', Proc. Int. Workshop on Information Security Applications, 2005, p. 188-203
8. Geschke D.: 'Fast logging project for Snort', Available at http://www.geschke-online.de/doc/index.html, 2006
9. Aldwairi, M., Conte, T., and Franzon, P.: ' Configurable string matching hardware for speeding up intrusion detection ', ACM SIGARCH Comput. Archit. News, 2005, 33, (1), p. 99-107
10. Weinsberg, Y., Tzur-David, S., Dolev, D., and Anker, T.L.: ' One algorithm to match them all: on a generic NIPS pattern matching algorithm ', Proc. 2007 Conf. High Performance Switching and Routing (HPSR'07), Brooklyn Bridge, NY, May, 30, 2007, p. 1-6
11. Yu, J., Xue, Y., and Li, J.: ' Memory efficient string matching algorithm for network intrusion management system ', J. Tsinghua Sci. Technol., 2007, 12, (7), p. 585-593
12. Coppens, J., De Smet, S., den Berghe, S., De Turck, F., and Demeester, P.: ' Performance evaluation of a probabilistic packet filter optimization algorithm for high-speed network monitoring ', Proc. Seventh IEEE Conf. High Speed Networks and Multimedia Communications, HSNMC 2004, Toulouse, France, June, 2004, p. 120-131
13. Sourdis, I., Dimopoulos, V., Pnevmatikatos, D., and Vassiliadis, S.: ' Packet pre-filtering for network intrusion detection ', Proc. ACM/IEEE Symposium on Architectures for Networking and Communications System, ANCS'06, San Jose, CA, December, 2006, p. 183-192
14. Cho, Y., and Mangione-Smith, W.: ' Deep network packet filter design for reconfigurable devices ', ACM Trans. Embedded Comput. Syst., 2008, 7, (2), p. 26, Article 21
15. Baker, Z., and Prasanna, K.: ' High-throughput linked-patter matching for intrusion detection systems ', Proc. ACM/IEEE Symp. Architectures for Networking and Communications System, ANCS'05, Princeton, NJ, October, 2005, p. 193-202
16. Lin, C., Tai, Y., and Chang, S.: ' Optimization of pattern matching algorithm for memory based architecture ', Proc. ACM/IEEE Symp. Architectures for Networking and Communications System, ANCS'07, Orlando, FL, December, 2007, p. 11-16
17. Mitra, A., Najjar, W., and Bhuyan, L.: ' Compiling PCRE to FPGA for accelerating Snort IDS ', Proc. ACM/IEEE Symp. Architectures for Networking and Communications System, ANCS'07, Orlando, FL, December, 2007, p. 127-135
18. Antonatos, S., Anagnostakis, K.G., Markatos, E.P., and Polychronakis, M.: ' Performance analysis of content matching intrusion detection systems ', Proc. Int. Symp. Applications and the Internet (SAINT2004), January, 2004, p. 208
19. Deri, L.: ' nCap: wire-speed packet capture and transmission ', Proc. Third IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services (E2EMON), Nice, France, 2005
20. The Snort Project: 'Snort users manual 2.81', March 12, 2008, available at http://www.snort.org/
21. Biswas, A., and Sinha, P.: ' Efficient real-time Linux interface for PCI devices: a study on hardening a network intrusion detection system ', Proc. Fifth System Administration and Network Engineering Conference, SANE 2006, Delft, The Netherlands, May, 15-19, 2006
22. Salah, K., and Kahtani, A.: ' Boosting throughput of Snort NIDS under Linux ', Proc. Fifth IEEE Int. Conf. Innovations in Information Technology (Innovations'08), December, 16-18, 2008
23. Carr J.: Snort: open source network intrusion prevention', eSecurityPlanet, June 5, 2007, available at http://www.esecurityplanet.com/ article.php/11162-3681296-1
24. Markatos, E., Antonatos, S., Polychronakis, M., and Anagnostakis, K.: ' Exclusion-based signature matching for intrusion detection ', Proc. IASTED Int. Conf. Communications and Computer Networks, CCN, 2002
25. Rivest, R.L.: ' On the worst-case behavior of string-searching algorithms ', SIAM J. Comput., 1977, 6, (4), p. 669-674 0097-5397
26. Salim, J.H.: ' Beyond Softnet ', Proc. Fifth Annual Linux Showcase and Conf., November, 2001, p. 165-172
27. Benvenuti, C.: ' Understanding Linux network internals ', (O'Rilley Press, 2005, December)
28. Wu, W., Crawford, M., and Bowden, M.: ' The performance analysis of Linux networking - packet receiving ', Int. J. Comput. Commun., 2007, 30, (5), p. 1044-1057
29. Ramakrishnan, K.: ' Performance consideration in designing network interfaces ', IEEE J. Sel. Areas Commun., 1993, 11, (2), p. 203-219 0733-8716
30. Bovet, D., and Cesati, M.: ' Understanding the Linux kernel ', 3rd (O'Rilley Press, 2005, November)
31. Chandy, K.M., and Sauer, C.H.: ' Approximate methods for analyzing queueing network models of computing systems ', J. ACM Comput. Surveys, 1978, 10, (3), p. 281-317
32. Salah, K., El-Badawi, K., and Haidari, F.: ' Performance analysis and comparison of interrupt-handling schemes in gigabit networks ', J. Comput. Commun., 2007, 30, (17), p. 3225-3441
33. Paxson, V., and Floyd, S.: ' Wide-AREA TRAffiC: the failure of Poisson modeling ', IEEE/ACM Trans. Netw., 1995, 3, (3), p. 226-244 1063-6692
34. Kleinrock, L.: ' Queueing systems ', (Wiley Interscience, New York, 1975), 2, Computer applications
35. Rubini, A., and Corbet, J.: ' The Linux device drivers ', (O'Reilly, 2001)
36. ' KUTE - a high performance kernel-based UDP traffic engine ', Technical Report 050118A, Center for Advanced Internet Architectures (CAIA)
37. Emma D., Pescape A., Ventre G.: 'D-ITG, Distributed Internet traffic generator', available at http://www.grid.unina.it/software/ITG
38. Olsson, R.: ' pktgen the Linux packet generator ', Proc. Linux Symp., Ottawa, Canada, 2005