Virtualization efficacy for Network Intrusion Detection Systems in high speed environment

Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering

Volumn 41 LNICST, Issue , 2010, Pages 26-41

  Akhlaq, Monis ^a   Alserhani, Faeiz ^a   Awan, Irfan U ^a   Mellor, John ^a   Cullen, Andrea J ^a   Mirchandani, Pravin ^b  

^a UNIVERSITY OF BRADFORD   (United Kingdom)

^b Syphan Technologies   (United Kingdom)

Author keywords

Network intrusion detection systems; Operating systems; Performance evaluation; Snort; Virtualization

Indexed keywords

APPLICATION ANALYSIS; HARDWARE PLATFORM; HIGH-SPEED; MULTIPLE INSTANCES; NETWORK INTRUSION DETECTION SYSTEMS; NETWORK REQUIREMENTS; OPEN SOURCES; PERFORMANCE EVALUATION; PERFORMANCE LIMITATIONS; RESEARCH COMMUNITIES; RESOURCE SHARING; SNORT; TEST-BENCH; TRAFFIC CONDITIONS; VIRTUAL PLATFORM; VIRTUAL SYSTEMS; VIRTUALIZATIONS; WINDOWS XP;

COMPUTER CRIME; COMPUTER OPERATING SYSTEMS; ELECTRONIC CRIME COUNTERMEASURES; EMBEDDED SYSTEMS; ENGINEERING RESEARCH; INFORMATION DISSEMINATION; NETWORK PERFORMANCE; NETWORK SECURITY; SYSTEMS ANALYSIS; VIRTUAL REALITY;

INTRUSION DETECTION;

EID: 84885891439     PISSN: 18678211     EISSN: None     Source Type: Book Series    
DOI: 10.1007/978-3-642-11530-1_4     Document Type: Conference Paper

References (29)

1. Singh, A.: An Introduction to Virtualization, http://www.kernelthread. com/publications/virtualization
2. Business value of virtualization: Realizing the benefits of integrated solutions, http://h18000.www1.hp.com/products/servers/management/vse/Biz- Virtualization-WhitePaper.pdf
3. Virtualization, http://www.windowsecurity.com/whitepapers/Virtualization. html
4. Inella, P.: An Introduction to IDS, http://www.securityfocus.com/infocus/ 1520
5. Shannon, C., Moore, D.: The spread of the Witty Worm. IEEE Security and Privacy 2(4), 46-50 (2004)
6. Buffer overflow, http://www.mcafee.com/us/local-content/white-papers/wp- ricochetbriefbuffer.pdf
7. The spread of Witty worms, http://www.caida.org/research/security/witty
8. Snort, http://www.Snort.org/
9. Baker, A.R., Esler, J.: Snort IDS and IPS Toolkit, Syngress, Canada (2007)
10. Alserhani, F., Akhlaq, M., Awan, I., Cullen, A., Mellor, J., Mirchandani, P.: Evaluating Intrusion Detection Systems in High Speed Networks. In: Fifth International Conference of Information Assurance and Security (IAS 2009). IEEE Computer Society, Los Alamitos (in press, 2009)
11. VMware Server, http://www.vmware.com/products/server/
12. Windows Server (2008), http://www.microsoft.com/windowsserver2008/en/us/ default.aspx
13. Windows XP SP2, http://www.softwarepatch.com/windows/xpsp2.html
14. Linux 2.6, http://www.kernel.org/
15. Free BSD 7.1, http://www.freebsd.org/where.html
16. Xu, J., Zhao, M., Fortes, J.A.B., Carpenter, R., Yousif, M.: On the Use of Fuzzy Modelling in Virtualized Data Center Management. In: Proceedings of 4th International Conference on Autonomic Computing, ICAC 2007 (June 2007)
17. Virtualization and disk performance /pdf/Virtualization-,http://files. diskeeper.comPerformance.pdf
18. Schneider, F., Wallerich, J., Feldmann, A.: Packet capture in 10-gigabit ethernet environments using contemporary commodity hardware. In: Uhlig, S., Papagiannaki, K., Bonaventure, O. (eds.) PAM 2007. LNCS, vol. 4427, pp. 207-217. Springer, Heidelberg (2007)
19. Optimizing network infrastructure for virtualization, http://www.dell.com/downloads/global/power/ps3q08-20080375-Intel.pdf
20. Salim, J.H., Olsson, R., Kuznetsov, A.: Beyond Softnet. In: Proceedings of USENIX 2001, November 2001, pp. 165-172 (2001)
21. Deri, L.: Improving Passive Packet Capture: Beyond Device Polling. In: Proceedings of the 4th International System Administration and Network Engineering Conference, Amsterdam (September 2004)
22. Biswas, A., Sinha, P.: A high performance packet capturing support for Alarm Management Systems. In: 17th International conference on Parallel and Distributed Computing and Systems (PDCS), Phoenix (2005)
23. Salah, K., El-Badawi, K.: Performance Evaluation of Interrupt-Driven Kernels in Gigabit Networks. In: The IEEE Global Telecommunications Conference, GLOECOM 2003, December 2003, pp. 3953-3957 (2003)
24. ProCurve Series 2900 switch, http://www.hp.com/rnd/products/switches/HP- ProCurve
25. LAN Traffic V 2, http://www.topshareware.com/lan-traffic-v2/downloads/1. html
26. D-ITG V 2.6, http://www.grid.unina.it/Traffic/index.php
27. Berkley Packet Filter, http://www.freebsd.org/releases/7.1R/relnotes.htm
28. SATA Technology, http://www.serialata.org/
29. Disk Queue Length Counter, http://www.windowsnetworking.com/articles- tutorials/Windows-Server-2003-PerfTuning.html