Shunting: a hardware/software architecture for flexible, high-performance network intrusion prevention

Stateful, in-depth, inline traffic analysis for intrusion detection and prevention is growing increasingly more difficult as the data rates of modern networks rise. Yet it remains the case that in many environments, much of the traffic comprising a high-volume stream can, after some initial analysis, be qualified as of “likely uninteresting.” We present a combined hardware/software architecture, Shunting, that provides a lightweight mechanism for an intrusion prevention system (IPS) to take advantage of the “heavy-tailed” nature of network traffic to offload work from software to hardware.

• Type: Conference
• Year: 2007
• Where: CCS
• Authors: José M. González, Vern Paxson, Nicholas Weaver
• Keywords: CCS 2007, Inline Traffic Analysis, Intrusion Detection, Modern Networks, Security Privacy