SPANIDS: a scalable network intrusion detection loadbalancer

Network intrusion detection systems (NIDS) are becoming an increasingly important security measure. With rapidly increasing network speeds, the capacity of the NIDS sensor can limit the ability of the system to detect intrusions. The SPANIDS parallel NIDS architecture overcomes this limitation by distributing network traffic load over an array of sensor nodes. Based on a custom hardware load balancer and cost-effective off-the-shelf sensors, the system employs novel stateless load balancing heuristics to thwart scalability limitations. It also uses dynamic feedback from the sensor nodes to adapt to changes in network traffic. This paper describes the overall system architecture, discusses some of the critical design decisions and presents experimental results that demonstrate the performance advantage of this approach. Categories and Subject Descriptors C.0 [Computer Systems Organization]: General—System Architectures; C.4 [Computer Systems Organization]: Design Studies; H.4 [Info...

• Type: Conference
• Year: 2005
• Where: CF
• Authors: Lambert Schaelicke, Kyle Wheeler, Curt Freeland
• Keywords: Applied Computing, CF 2005, Load Balancer, Network Intrusion Detection, Sensor Nodes