New opportunities for load balancing in network-wide intrusion detection systems

CoNEXT 2012 - Proceedings of the 2012 ACM Conference on Emerging Networking Experiments and Technologies

Volumn , Issue , 2012, Pages 361-372

  Heorhiadi, Victor ^a   Reiter, Michael K ^a   Sekar, Vyas ^b  

^a UNIVERSITY OF NORTH CAROLINA   (United States)

^b STONY BROOK UNIVERSITY   (United States)

Author keywords

Intrusion detection; Network management

Indexed keywords

COMMUNICATION COST; COMPUTATION LOADS; DETECTION COVERAGE; INTERMEDIATE RESULTS; INTRUSION DETECTION SYSTEMS; NETWORK INTRUSION DETECTION SYSTEMS; PRACTICAL SOLUTIONS; REAL-WORLD NETWORKS; TRAFFIC PATTERN; TRAFFIC VOLUMES;

COMPUTER CRIME; ELECTRIC NETWORK TOPOLOGY; EXPERIMENTS; NETWORK MANAGEMENT;

INTRUSION DETECTION;

EID: 84871967397     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2413176.2413218     Document Type: Conference Paper

References (43)

1. Powering virtual network services. http://embrane.com.
2. ZScaler Cloud Security. http://www.zscaler.com.
3. Allman, M., Kreibich, C., Paxson, V., Sommer, R., and Weaver, N. Principles for developing comprehensive network visibility. In Proc. HOTSEC'08, 2008.
4. Bittwist. http://bittwist.sourceforge.net.
5. Bob hash. http://burtleburtle.net/bob/hash/doobs.html.
6. Cantieni, G. R., Iannaccone, G., Barakat, C., Diot, C., and Thiran, P. Reformulating the monitor placement problem: optimal network-wide sampling. In Proc. CoNEXT '06, 2006.
7. Cisco blade servers. http://www.cisco.com/en/US/products/ps10280/index. html.
8. Dreger, H., Feldmann, A., Paxson, V., and Sommer, R. Predicting the resource consumption of network intrusion detection systems. In Proc. SIGMETRICS '08, 2008.
9. Feldmann, A., Greenberg, A., Lund, C., Reingold, N., Rexford, J., and True, F. Deriving traffic demands for operational IP networks: methodology and experience. IEEE/ACM Trans. Netw., 9(3):265-280, June 2001.
10. Fortz, B., Rexford, J., and Thorup, M. Traffic engineering with traditional IP routing protocols. Communications Magazine, IEEE, 40(10):118-124, Oct 2002.
11. Gibb, G., Zeng, H., and McKeown, N. Outsourcing network functionality. In Proc. HotSDN, 2012.
12. Greenberg, A., Hjalmtysson, G., Maltz, D. A., Myers, A., Rexford, J., Xie, G., Yan, H., Zhan, J., and Zhang, H. A clean slate 4D approach to network control and management. SIGCOMM Comput. Commun. Rev., 35(5):41-54, Oct. 2005.
13. Heorhiadi, V., Reiter, M. K., and Sekar, V. Balancing computation-communication tradeoffs in scaling network-wide intrusion detection systems. Technical Report TR12-001, UNC Chapel Hill, 2012.
14. Internet2 trafficx matrices. http://www.cs.utexas.edu/~yzhang/research/ AbileneTM.
15. Kohler, E., Morris, R., Chen, B., Jannotti, J., and Kaashoek, M. F. The click modular router. ACM Trans. Comput. Syst., 18(3):263-297, Aug. 2000.
16. Lakhina, A., Crovella, M., and Diot, C. Diagnosing network-wide traffic anomalies. In Proc. SIGCOMM '04, 2004.
17. Lee, J., Hwang, S. H., Park, N., Lee, S.-W., Jun, S., and Kim, Y. S. A high performance NIDS using FPGA-based regular expression matching. In Proc. SAC '07, 2007.
18. M57 packet traces. https://domex.nps.edu/corp/scenarios/2009-m57/net/.
19. McKeown, N., Anderson, T., Balakrishnan, H., Parulkar, G., Peterson, L., Rexford, J., Shenker, S., and Turner, J. OpenFlow: enabling innovation in campus networks. SIGCOMM Comput. Commun. Rev., 38(2):69-74, Mar. 2008.
20. Meiners, C. R., Patel, J., Norige, E., Torng, E., and Liu, A. X. Fast regular expression matching using small TCAMs for network intrusion detection and prevention systems. In Proc. USENIX Security'10, 2010.
21. Mohan, C. and Lindsay, B. Efficient commit protocols for the tree of processes model of distributed transactions. SIGOPS Oper. Syst. Rev., 19(2):40-52, Apr. 1985.
22. Network security spending to soar in the next 5 year. http://www.v3.co.uk/v3-uk/news/1998293/network-security-spending-soar.
23. PAPI: Performance application programming interface. http://icl.cs.utk. edu/papi/.
24. Paxson, V. Bro: a system for detecting network intruders in real-time. In Proc. Usenix Security'98, 1998.
25. Pfq homepage. http://netserv.iet.unipi.it/software/pfq/.
26. Pf-ring. http://www.ntop.org/products/pf-ring/.
27. Roughan, M. Simplifying the synthesis of internet traffic matrices. SIGCOMM Comput. Commun. Rev., 35(5):93-96, Oct. 2005.
28. Scapy packet manipulation toolkit. http://www.secdev.org/projects/scapy/.
29. Sekar, V., Krishnaswamy, R., Gupta, A., and Reiter, M. K. Network-wide deployment of intrusion detection and prevention systems. In Proc. CoNEXT '10, 2010.
30. Sekar, V., Ratnasamy, S., Reiter, M. K., Egi, N., and Shi, G. The middlebox manifesto: enabling innovation in middlebox deployment. In Proc. HotNets '11, 2011.
31. Shaikh, A. and Greenberg, A. Ospf monitoring: architecture, design and deployment experience. In Proc. NSDI'04, 2004.
32. Sherry, J., Hasan, S., Scott, C., Krishnamurthy, A., Ratnasamy, S., and Sekar, V. Making middleboxes someone else's problem: Network processing as a cloud service. In Proc. SIGCOMM, 2012.
33. Smith, R., Estan, C., and Jha, S. XFA: Faster signature matching with extended automata. In Proc. IEEE S&P'08, 2008.
34. Snort. http://www.snort.org.
35. Spring, N., Mahajan, R., Wetherall, D., and Anderson, T. Measuring isp topologies with rocketfuel. IEEE/ACM Trans. Netw., 12(1):2-16, Feb. 2004.
36. Teixeira, R., Shaikh, A., Griffin, T., and Rexford, J. Dynamics of hot-potato routing in IP networks. In Proc. SIGMETRICS '04/Performance '04, 2004.
37. Vallentin, M., Sommer, R., Lee, J., Leres, C., Paxson, V., and Tierney, B. The NIDS cluster: scalable, stateful network intrusion detection on commodity hardware. In Proc. RAID'07, 2007.
38. Vasiliadis, G., Polychronakis, M., Antonatos, S., Markatos, E. P., and Ioannidis, S. Regular expression matching on graphics hardware for intrusion detection. In Proc. RAID '09, 2009.
39. Vasiliadis, G., Polychronakis, M., and Ioannidis, S. MIDeA: a multi-parallel intrusion detection architecture. In Proc. CCS '11, 2011.
40. White, B., Lepreau, J., Stoller, L., Ricci, R., Guruprasad, S., Newbold, M., Hibler, M., Barb, C., and Joglekar, A. An integrated experimental environment for distributed systems and networks. SIGOPS Oper. Syst. Rev., 36(SI):255-270, Dec. 2002.
41. World intrusion detection and prevention markets. http://www-935.ibm.com/ services/us/iss/pdf/esr-intrusion-detection-and-prevention-systems-markets.pdf.
42. Yu, F., Lakshman, T. V., Motoyama, M. A., and Katz, R. H. SSA: a power and memory efficient scheme to multi-match packet classification. In Proc. ANCS '05, 2005.
43. Zhang, Y. and Paxson, V. Detecting stepping stones. In Proc. Usenix Security'00, 2000.