Carousel: Scalable Logging for Intrusion Prevention Systems

We address the problem of collecting unique items in a large stream of information in the context of Intrusion Prevention Systems (IPSs). IPSs detect attacks at gigabit speeds and must log infected source IP addresses for remediation or forensics. An attack with millions of infected sources can result in hundreds of millions of log records when counting duplicates. If logging speeds are much slower than packet arrival rates and memory in the IPS is limited, scalable logging is a technical challenge. After showing that na

• Type: Conference
• Year: 2010
• Where: NSDI
• Authors: Vinh The Lam, Michael Mitzenmacher, George Varghese
• Keywords: Computer Networks, Infected Source Ip, Infected Sources, IPSs Detect Attacks, NSDI 2010