Scalable high-performance parallel design for Network Intrusion Detection Systems on many-core processors

ANCS 2013 - Proceedings of the 9th ACM/IEEE Symposium on Architectures for Networking and Communications Systems

Volumn , Issue , 2013, Pages 137-146

  Jiang, Haiyang ^a   Zhang, Guangxing ^a   Xie, Gaogang ^a   Salamatian, Kave ^b   Mathy, Laurent ^c  

^a INSTITUTE OF GEOLOGY AND GEOPHYSICS   (China)

^b UNIVERSITÉ DE SAVOIE   (France)

^c UNIVERSITY OF LIÈGE   (Belgium)

Author keywords

load balancing; many core; network intrusion detection system; parallel

Indexed keywords

COMPLEX NETWORKS; COMPUTER CRIME; DESIGN; INTRUSION DETECTION; NETWORK ARCHITECTURE; PARALLEL ARCHITECTURES; RESOURCE ALLOCATION;

HARDWARE-ACCELERATED; HYBRID PARALLEL ARCHITECTURES; LOAD-BALANCING SCHEMES; MANY-CORE; MANY-CORE PROCESSORS; NETWORK INTRUSION DETECTION SYSTEMS; PARALLEL; PIPELINE PARALLELISMS;

PARALLEL PROCESSING SYSTEMS;

EID: 84893491705     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ANCS.2013.6665196     Document Type: Conference Paper

References (29)

1. V. Paxson. Bro: A System for Detecting Network Intruders in Real-time. In Proceedings of the 7th Conference on USENIX Security Symposium, 1998
2. Zachary K. Baker and Viktor K. Prasanna, "High-throughput Linked-Pattern Matching for Intrusion Detection Systems", In ANCS 2005, Oct 26-28, 2005, Princeton, New Jersey, USA
3. V. Paxson, R. Sommer, and N. Weaver, "An architecture for exploiting multi-core processors to parallelize network intrusion prevention" In Proceedings IEEE Sarnoff Symposium, May 2007
4. J. Lee, S. H. Hwang, N. Park, S.-W. Lee, S. Jun, and Y. S. Kim. A High Performance NIDS Using FPGA-based Regular Expression Matching. In Proceedings of the 22nd ACM Symposium on Applied computing (SAC), 2007
5. Mitra, W. Najjar, and L. Bhuyan. Compiling PCRE to FPGA for accelerating SNORT IDS. In Proceedings of the 3rd ACM/IEEE Symposium on Architecture for Networking and Communications Systems, ANCS, 2007
6. M. Colajanni and M. Marchetti, "A parallel architecture for stateful intrusion detection in high traffic networks", IEEE IST Workshop on Monitoring, Attack Detection and Mitigation, Tuebingen, Germany, Sept. 2006
7. Kim, Sunil, and Jun-yong Lee. "A system architecture for high-speed deep packet inspection in signature-based network intrusion prevention." Journal of Systems Architecture 53.5 (2007): 310-320.
8. G. Vasiliadis, M. Polychronakis, and S. Ioannidis. "MIDeA: A Multi-Parallel Intrusion Detection Architecture", In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2011.
9. M. Jamshed, J. Lee, S. Moon, I. Yun, D. Kim, S. Lee, Y. Yi, and K. Park. "Kargus: a highly-scalable software-based intrusion detection system", In Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2012
10. http://vrt-blog.snort.org
11. J. Cabrera, J. Gosar, W. Lee, and R. Mehra, - a?rOn the statistical distribution of processing times in network intrusion detection - ás In 43rd IEEE Conference on Decision and Control, Dec 2004, pp. 75́lC80.
12. TILE-Gx8036 product brief http://www.tilera.com/sites/default/files/ productbriefs/TILE-Gx8036 PB033-02 web.pdf
13. Salminen, Erno, Ari Kulmala, and Timo D. Hamalainen. "Survey of network-on-chip proposals." white paper, OCP-IP (2008): 1-13.
14. www.suricata-ids.org
15. www.openinfosecfoundation.org
16. Wentzlaff, David, et al. "On-chip interconnection architecture of the tile processor."Micro, IEEE 27.5 (2007): 15-31.
17. Sourdis, Ioannis, et al. "Packet pre-filtering for network intrusion detection." ACM/IEEE Symposium on Architecture for Networking and Communications systems, 2006
18. Suleman, M. Aater, Moinuddin K. Qureshi, and Yale N. Patt. "Feedback-directed pipeline parallelism." Proceedings of the 19th international conference on Parallel architectures and compilation techniques. ACM, 2010.
19. Supra-linear packet processing performance with intel multi-core processors white paper. Intel Corporation, 2006.
20. Removing System Bottlenecks in Multi-threaded Applications white paper. Intel Corporation, 2008.
21. Schuff, Derek L., Yung Ryn Choe, and Vijay S. Pai. "Conservative vs. optimistic parallelization of stateful network intrusion detection." IEEE International Symposium on Performance Analysis of Systems and software, 2008
22. Chen, Xinming, et al. "Para-snort: A multi-thread snort on multi-core ia platform." Proceedings of Parallel and Distributed Computing and Systems (PDCS) (2009).
23. Martin, Ruediger, Michael Menth, and Michael Hemmkeppler. "Accuracy and dynamics of hash-based load balancing algorithms for multipath Internet routing." Broadband Communications, IEEE International Conference on Networks and Systems, 2006
24. Weiguang Shi, Lukas Kencl, Sequence-preserving adaptive load balancers, Proceedings of the 2006 ACM/IEEE symposium on Architecture for networking and communications systems, December 03-05, 2006, San Jose, California, USA
25. Haiyang Jiang, Gaogang Xie, Kav́e Salamatian, Load Balancing by Ruleset Partition for Parallel IDS on Multi-Core Processors, International Conference on Computer Communications and Networks, ICCCN 2013
26. C. Grozea, Z. Bankovic, and P. Laskov, FPGA vs. multi-core cpus vs. gpus: Hands-on experience with a sorting application, In Conference Facing the Multicore-Challenge, pp.105-117, 2010
27. P. P. C. Lee, T. Bu, and G. P. Chandranmenon, A Lock-free, Cache efficient Multi-core Synchronization Mechanism for Line-rate Network Traffic Monitoring, in IEEE International Symposium on Parallel and Distributed Processing (IPDPS 2010), Atlanta, GA, April 2010, pp.1012
28. http://oprofile.sourceforge.net/download
29. Xie, Gaogang, et al. "PEARL: a programmable virtual router platform." Communications Magazine, IEEE 49.7 (2011): 71-77.