NDLI: Packet pre-filtering for network intrusion detection

Please wait, while we are loading the content...

A proposed architecture for the GENI backbone platform

Packet classification using coarse-grained tuple spaces

Efficient memory utilization on network processors for deep packet inspection

An effective network processor design framework: using multi-objective evolutionary algorithms and object oriented techniques to optimise the intel IXP1200 network processor

Sequence-preserving adaptive load balancers

Scalable network-based buffer overflow attack detection

Towards an efficient switch architecture for high-radix switches

CAMP: fast and efficient IP lookup architecture

Advanced algorithms for fast and scalable deep packet inspection

A methodology for evaluating runtime support in network processors

Localized asynchronous packet scheduling for buffered crossbar switches

WormTerminator: an effective containment of unknown and polymorphic fast spreading worms

A practical fast parallel routing architecture for Clos networks

Fast packet classification using bloom filters

Fast and memory-efficient regular expression matching for deep packet inspection

High-throughput sketch update on a low-power stream processor

Packet pre-filtering for network intrusion detection

Design of a web switch in a reconfigurable platform

Symerton--using virtualization to accelerate packet processing

Packet pre-filtering for network intrusion detection

Content Provider	ACM Digital Library
Author	Pnevmatikatos, Dionisios Sourdis, Ioannis Dimopoulos, Vasilis Vassiliadis, Stamatis
Abstract	As Intrusion Detection Systems (IDS)utilize more complex syntax to efficiently describe complex attacks, their processing requirements increase rapidly. Hardware and, even more, software platforms face difficulties in keeping up with the computationally intensive IDS tasks, and face overheads that can substantially diminish performance.In this paper we introduce a packet pre-filtering approach as a means to resolve, or at least alleviate, the increasing needs of current and future intrusion detection systems. We observe that it is very rare for a single incoming packet to fully or partially match more than a few tens of IDS rules. We capitalize on this observation selecting a small portion from each IDS rule to be matched in the pre-filtering step. The result of this partial match is a small subset of rules that are candidates for a full match. Given this pruned set of rules that can apply to a packet, a second-stage, full-match engine can sustain higher throughput.We use DefCon traces and recent Snort IDS rule-set,and show that matching the header and up to an 8-character prefix for each payload rule on each incoming packet can determine that on average 1.8 rules may apply on each packet, while the maximum number of rules to be checked across all packets is 32. Effectively, packet pre-filtering prevents matching at least 99%of the SNORT rules per packet and as a result minimizes processing and improves the scalability of the system. We also propose and evaluate the cost and performance of a reconfigurable architecture that uses multiple processing engines in order to exploit the benefits of pre-filtering.
Starting Page	183
Ending Page	192
Page Count	10
File Format	PDF
ISBN	1595935800
DOI	10.1145/1185347.1185372
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2006-12-03
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Packet inspection Intrusion detection Packet pre-filtering
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in