MIDeA: a multi-parallel intrusion detection architecture

Network intrusion detection systems are faced with the challenge of identifying diverse attacks, in extremely high speed networks. For this reason, they must operate at multi-Gigabit speeds, while performing highly-complex per-packet and per-flow data processing. In this paper, we present a multi-parallel intrusion detection architecture tailored for high speed networks. To cope with the increased processing throughput requirements, our system parallelizes network traffic processing and analysis at three levels, using multi-queue NICs, multiple CPUs, and multiple GPUs. The proposed design avoids locking, optimizes data transfers between the different processing units, and speeds up data processing by mapping different operations to the processing units where they are best suited. Our experimental evaluation shows that our prototype implementation based on commodity off-the-shelf equipment can reach processing speeds of up to 5.2 Gbit/s with zero packet loss when analyzing traffic i...

• Type: Journal
• Year: 2011
• Where: CCS
• Authors: Giorgos Vasiliadis, Michalis Polychronakis, Sotiris Ioannidis
• Keywords: CCS 2011, Intrusion Detection Systems, Network Intrusion Detection, Network Intrusion Detection Systems, Security Privacy