LEoNIDS: A Low-Latency and Energy-Efficient Network-Level Intrusion Detection System

IEEE Transactions on Emerging Topics in Computing

Volumn 4, Issue 1, 2016, Pages 142-155

  Tsikoudis, Nikos ^a   Papadogiannakis, Antonis ^b   Markatos, Evangelos P ^b  

^a BRANDEIS UNIVERSITY   (United States)

^b INSTITUTE OF COMPUTER SCIENCE   (Greece)

Author keywords

Energy Efficient Systems; Intrusion Detection Systems; Low Latency; Low Power design; Multi Core Packet Processing; Network Security; Performance

Indexed keywords

COMPUTER CRIME; DESIGN; ELECTRIC POWER SUPPLIES TO APPARATUS; ELECTRIC POWER UTILIZATION; ENERGY EFFICIENCY; INTRUSION DETECTION; LOW POWER ELECTRONICS; MERCURY (METAL); MOBILE DEVICES; PACKET NETWORKS; SYSTEMS ANALYSIS;

ENERGY EFFICIENT SYSTEMS; INTRUSION DETECTION SYSTEMS; LOW LATENCY; LOW-POWER DESIGN; PACKET PROCESSING; PERFORMANCE;

NETWORK SECURITY;

EID: 84963778729     PISSN: None     EISSN: 21686750     Source Type: Journal    
DOI: 10.1109/TETC.2014.2369958     Document Type: Article

References (30)

1. K. Shen, A. Shriraman, S. Dwarkadas, X. Zhang, and Z. Chen, "Power containers: An OS facility for-ne-grained power and energy management on multicore servers," in Proc. ACM Int. Conf. Archit. Support Program. Lang. Oper. Syst. (ASPLOS), 2013, pp. 65-76
2. Q. Deng, D. Meisner, L. Ramos, T. F. Wenisch, and R. Bianchini, "MemScale: Active low-power modes for main memory," in Proc. ACM Int. Conf. Archit. Support Program. Lang. Oper. Syst. (ASPLOS), 2011, pp. 225-238
3. A. Pathak, Y. C. Hu, and M. Zhang, "Where is the energy spent inside my app?: Fine grained energy accounting on smartphones with Eprof," in Proc. ACM Eur. Conf. Comput. Syst. (EuroSys), 2012, pp. 29-42
4. M. Gupta and S. Singh, "Greening of the internet," in Proc. ACM SIGCOMM Conf. Data Commun., 2003, pp. 19-26
5. V. Paxson, R. Sommer, and N. Weaver, "An architecture for exploiting multi-core processors to parallelize network intrusion prevention," in Proc. IEEE Sarnoff Symp., Apr./May 2007, pp. 1-7
6. C. Kruegel, F. Valeur, G. Vigna, and R. Kemmerer, "Stateful intrusion detection for high-speed networks," in Proc. IEEE Symp. Secur. Privacy, May 2002, pp. 285-293
7. M. Vallentin, R. Sommer, J. Lee, C. Leres, V. Paxson, and B. Tierney, "The NIDS cluster: Scalable, stateful network intrusion detection on commodity hardware," in Proc. Int. Symp. Recent Adv. Intrusion Detec-tion (RAID), 2007, pp. 107-126
8. M. Roesch, "Snort-Lightweight intrusion detection for networks," in Proc. USENIX Large Installation Syst. Admin. Conf. (LISA), 1999, pp. 229-238
9. Snort Active Response. [Online]. Available: http://manual.snort.org/node26.html
10. H. Dreger, A. Feldmann, V. Paxson, and R. Sommer, "Operational experi-ences with high-volume network intrusion detection," in Proc. ACM Conf. Comput. Commun. Secur. (CCS), 2004, pp. 2-11
11. Source-re Vulnerability Research Team (VRT). [Online]. Available: http://www.snort.org/vrt
12. F. Fusco and L. Deri, "High speed network traf-c analysis with com-modity multi-core systems," in Proc. ACM SIGCOMM Conf. Internet Meas. (IMC), 2010, pp. 218-224
13. Intel Server Adapters. Receive Side Scaling on Intel Network Adapters. [Online]. Available: http://www.intel.com/support/network/adapter/pro100/sb/cs-027574.htm
14. Intel. (2011). 82599 10 GbE Controller Datasheet. [Online]. Available: http://download.intel.com/design/network/datashts/82599-datasheet.pdf
15. M. Polychronakis, K. G. Anagnostakis, and E. P. Markatos, "An empirical study of real-world polymorphic code injection attacks," in Proc. USENIX Workshop Large-Scale Exploits Emergent Threats (LEET), 2009, p. 9
16. A. Papadogiannakis, M. Polychronakis, and E. P. Markatos, "Tolerating overload attacks against packet capturing systems," in Proc. USENIX Annu. Tech. Conf. (ATC), 2012, p. 18
17. A. Papadogiannakis, M. Polychronakis, and E. P. Markatos, "Improv-ing the accuracy of network intrusion detection systems under load using selective packet discarding," in Proc. ACM Eur. Workshop Syst. Secur. (EUROSEC), 2010, pp. 15-21
18. T. Limmer and F. Dressler, "Improving the performance of intrusion detection using dialog-based payload aggregation," in Proc. IEEE Global Internet Symp. (GI), Apr. 2011, pp. 822-827
19. G. Maier, R. Sommer, H. Dreger, A. Feldmann, V. Paxson, and F. Schneider, "Enriching network security analysis with time travel," in Proc. ACM SIGCOMM Conf. Data Commun., 2008, pp. 183-194
20. W. Fang and L. Peterson, "Inter-AS traf-c patterns and their implications," in Proc. IEEE Global Telecommun. Conf. (GLOBECOM), Dec. 1999, pp. 1859-1868
21. S. McCanne, C. Leres, and V. Jacobson. Libpcap. [Online]. Available: http://www.tcpdump.org
22. D. Meisner, B. T. Gold, and T. F.Wenisch, "PowerNap: Eliminating server idle power," in Proc. ACM Int. Conf. Archit. Support Program. Lang. Oper. Syst. (ASPLOS), 2009, pp. 205-216
23. S. Nedevschi, L. Popa, G. Iannaccone, S. Ratnasamy, and D. Wetherall, "Reducing network energy consumption via sleeping and rate-adaptation," in Proc. USENIX Symp. Netw. Syst. Design Implement. (NSDI), 2008, pp. 323-336
24. L. Niccolini, G. Iannaccone, S. Ratnasamy, J. Chandrashekar, and L. Rizzo, "Building a power-proportional software router," in Proc. USENIX Annu. Tech. Conf. (ATC), 2012, p. 8
25. M. F. Iqbal and L. K. John, "Ef-cient traf-c aware power management in multicore communications processors," in Proc. ACM/IEEE Symp. Archit. Netw. Commun. Syst. (ANCS), 2012, pp. 123-134
26. J. Kuang and L. Bhuyan, "Optimizing throughput and latency under given power budget for network packet processing," in Proc. IEEE Int. Conf. Comput. Commun. (INFOCOM), Mar. 2010, pp. 1-9
27. Y. Yu, B. Krishnamachari, and V. K. Prasanna, "Energy-latency tradeoffs for data gathering in wireless sensor networks," in Proc. IEEE Int. Conf. Comput. Commun. (INFOCOM), Mar. 2004, p. 255
28. G. Lu, B. Krishnamachari, and C. S. Raghavendra, "An adaptive energy-ef-cient and low-latency MAC for tree-based data gathering in sensor networks," Wireless Commun. Mobile Comput., vol. 7, no. 7, pp. 863-875, Sep. 2007
29. A. Pesterev, J. Strauss, N. Zeldovich, and R. T. Morris, "Improving net-work connection locality on multicore systems," in Proc. ACM Eur. Conf. Comput. Syst. (EuroSys), 2012, pp. 337-350
30. Y. Afek, A. Bremler-Barr, Y. Harchol, D. Hay, and Y. Koral, "MCA2: Multi-core architecture for mitigating complexity attacks," in Proc. ACM/IEEE Symp. Archit. Netw. Commun. Syst. (ANCS), Oct. 2012, pp. 235-246