Analysis of TLS Prefiltering for IDS Acceleration

• https://link.springer.com/chapter/10.1007/978-3-031-28486-1_5

IDS, TLS, DPDK, Prefilter, Suricata, Performance, Acceleration, Throughput,
Measurements

Network intrusion detection systems (IDS) and intrusion prevention systems (IPS)
have proven to play a key role in securing networks. However, due to their
computational complexity, the deployment is difficult and expensive. Therefore,
many times the IDS is not powerful enough to handle all network traffic on
high-speed network links without uncontrolled packet drop. High-speed packet
processing can be achieved using many CPU cores or an appropriate acceleration.
But the acceleration has to preserve the detection quality and has to be flexible
to handle ever-emerging security threats. One of the common acceleration methods
among intrusion detection/prevention systems is the bypass of encrypted packets
of the Transport Layer Security (TLS) protocol. This is based on the fact that
IDS/IPS cannot match signatures in the packet encrypted payload. The paper
provides an analysis and comparison of available TLS bypass solutions and
proposes a high-speed encrypted TLS Prefilter for further acceleration. We are
able to demonstrate that using our technique, the IDS performance has tripled and
at the same time detection results have resulted in a lower rate of false
positives. It is designed as a software-only architecture with support for
commodity cards. However, the architecture allows smooth transfer of the proposed
method to the HW-based solution in Field-programmable gate array (FPGA) network
interface cards (NICs).