Attack Signature Matching using Graphics Processors in High-Performance Intrusion Detection Systems
Publish place: 21th Iranian Conference on Electric Engineering
Publish Year: 1392
نوع سند: مقاله کنفرانسی
زبان: English
View: 1,034
This Paper With 7 Page And PDF Format Ready To Download
- Certificate
- من نویسنده این مقاله هستم
استخراج به نرم افزارهای پژوهشی:
شناسه ملی سند علمی:
ICEE21_140
تاریخ نمایه سازی: 27 مرداد 1392
Abstract:
Network Intrusion Detection Systems (NIDS) which should perform time-consuming evaluation of every packet received from network have faced throughput challenge as aresult of the increase in the speed of network communications and the high volume of Internet threats. In an NIDS, the mostimportant and time-consuming processes are pattern matching and deep inspection of the header and the body of packets. Several analyses show that this process can take upto 75% of the time of processing packets. In this paper, relying on the processing power of general purpose graphicscards – which seem to be a better option compared to other hardware technologies like FPGAs with regard to speed, scalability, flexibility, ease of programming and price – and with the idea of having the signature-based detection engine of NIDS systems run on GPU rather than CPU, it is tried topresent an efficient method to increase the speed of intrusion detection systems such as Snort. The proposed methodprovides a means to perform payload matching and nonpayloadmatching of packets in a parallel platform on GPU, which can speed up the signature-based detection engine of Snort 3.6.
Keywords:
Network Intrusion Detection Systems , Attack Signatures , Pattern Matching , Graphics Card , Throughput
Authors
Payam Mahdinia
Student of Master of Science of Computer Architecture, Isfahan University of Technology
Mehdi Berenjkoob
Assistant Professor of Electrical and Computer Engineering, Isfahan University of Technology
Hedayat Vatankhah
Master of Science of Artificial Intelligence, Payampardaz Engineering Co