Publication Details
General IDS Acceleration for High-Speed Networks
Kekely Lukáš, Ing., Ph.D. (DCSY)
Piecek Adam, Ing.
Kořenek Jan, doc. Ing., Ph.D. (DCSY)
Suricata IDS, high-speed networks, hardware acceleration
Network Intrusion Detection Systems have gained popularity as one of the key
technologies to secure communication infrastructures. However, their high
computational complexity poses performance challenges for practical deployment in
modern high-speed networks. To achieve the highest quality of detection, IDS
should process as much relevant data as it can without becoming the bottleneck of
a network connection. At the same time, IDS implementation should be flexible
enough to accommodate detection methods of ever emerging new security threats.
This paper aims at an acceleration of IDS by means of informed packet discarding,
effectively focusing the available resources of overloaded IDS to the most
relevant parts of analyzed traffic. Unlike previous works, the proposed scheme
does not move the IDS nor any specific portion of it into the hardware
accelerator. Rather it uses smart software based or hardware accelerated offload
(bypass) of the traffic parts that are not likely to represent a security threat.
The flexible nature of software-based IDS is therefore fully maintained, while
the quality of threat detection remains sufficiently high even when processing
high-speed traffic. We show that controlled (informed) discarding of well-defined
portions of input traffic yields better detection rates, compared to the default
uncontrolled (blind) buffer overflow discarding in high throughput scenarios. Our
results show that it is entirely possible to run an IDS on a high-speed network
link using single CPU with an FPGA accelerated packet pre-filtering.
@inproceedings{BUT155086,
author="Jan {Kučera} and Lukáš {Kekely} and Adam {Piecek} and Jan {Kořenek}",
title="General IDS Acceleration for High-Speed Networks",
booktitle="Proceedings - 2018 IEEE 36th International Conference on Computer Design, ICCD 2018",
year="2019",
pages="366--373",
publisher="Institute of Electrical and Electronics Engineers",
address="Orlando",
doi="10.1109/ICCD.2018.00062",
isbn="978-1-5386-8477-1",
url="https://www.fit.vut.cz/research/publication/11809/"
}