Publication Details

General IDS Acceleration for High-Speed Networks

KUČERA, J.; KEKELY, L.; PIECEK, A.; KOŘENEK, J. General IDS Acceleration for High-Speed Networks. In Proceedings - 2018 IEEE 36th International Conference on Computer Design, ICCD 2018. Orlando: Institute of Electrical and Electronics Engineers, 2019. p. 366-373. ISBN: 978-1-5386-8477-1.
Czech title
Obecná akcelerace IDS systémů pro vysokorychlostní počítačové sítě
Type
conference paper
Language
English
Authors
Kučera Jan, Ing., Ph.D. (DCSY)
Kekely Lukáš, Ing., Ph.D. (DCSY)
Piecek Adam, Ing.
Kořenek Jan, doc. Ing., Ph.D. (DCSY)
Keywords

Suricata IDS, high-speed networks, hardware acceleration

Abstract

Network Intrusion Detection Systems have gained popularity as one of the key technologies to secure communication infrastructures. However, their high computational complexity poses performance challenges for practical deployment in modern high-speed networks. To achieve the highest quality of detection, IDS should process as much relevant data as it can without becoming the bottleneck of a network connection. At the same time, IDS implementation should be flexible enough to accommodate detection methods of ever emerging new security threats. This paper aims at an acceleration of IDS by means of informed packet discarding, effectively focusing the available resources of overloaded IDS to the most relevant parts of analyzed traffic. Unlike previous works, the proposed scheme does not move the IDS nor any specific portion of it into the hardware accelerator. Rather it uses smart software based or hardware accelerated offload (bypass) of the traffic parts that are not likely to represent a security threat. The flexible nature of software-based IDS is therefore fully maintained, while the quality of threat detection remains sufficiently high even when processing high-speed traffic. We show that controlled (informed) discarding of well-defined portions of input traffic yields better detection rates, compared to the default uncontrolled (blind) buffer overflow discarding in high throughput scenarios. Our results show that it is entirely possible to run an IDS on a high-speed network link using single CPU with an FPGA accelerated packet pre-filtering.

Published
2019
Pages
366–373
Proceedings
Proceedings - 2018 IEEE 36th International Conference on Computer Design, ICCD 2018
ISBN
978-1-5386-8477-1
Publisher
Institute of Electrical and Electronics Engineers
Place
Orlando
DOI
10.1109/ICCD.2018.00062
UT WoS
000458293200051
EID Scopus
2-s2.0-85062206065
BibTeX 
@inproceedings{BUT155086,
  author="Jan {Kučera} and Lukáš {Kekely} and Adam {Piecek} and Jan {Kořenek}",
  title="General IDS Acceleration for High-Speed Networks",
  booktitle="Proceedings - 2018 IEEE 36th International Conference on Computer Design, ICCD 2018",
  year="2019",
  pages="366--373",
  publisher="Institute of Electrical and Electronics Engineers",
  address="Orlando",
  doi="10.1109/ICCD.2018.00062",
  isbn="978-1-5386-8477-1",
  url="https://www.fit.vut.cz/research/publication/11809/"
}
Files
Back to top