Generating realistic workloads for network intrusion detection systems

Abstract

While the use of network intrusion detection systems (nIDS) is becoming pervasive, evaluating nIDS performance has been found to be challenging. The goal of this study is to determine how to generate realistic workloads for nIDS performance evaluation. We develop a workload model that appears to provide reasonably accurate estimates compared to real workloads. The model attempts to emulate a traffic mix of different applications, reflecting characteristics of each application and the way these interact with the system. We have implemented this model as part of a traffic generator that can be extended and tuned to reflect the needs of different scenarios. We also present an approach to measuring the capacity of a nIDS that does not require the setup of a full network testbed.

A Flexible Pattern-Matching Algorithm for Network Intrusion Detection Systems Using Multi-Core Processors

“…Recall that the value of variable h is 3. After executing the foreach loop in Lines 7-9, T = {(5, 1), (6, 1), (7,4), (8, 2)}. Set T is sorted by the second coordinate in descending order, resulting in T = {(7, 4), (8, 2), (5, 1), (6, 1)}.…”

“…Set T is sorted by the second coordinate in descending order, resulting in T = {(7, 4), (8, 2), (5, 1), (6, 1)}. The foreach loop in Lines 11-20 initially selects (7,4) and checks to see if all child states of state 7 can be added to the head part. Since HEAD.…”

“…Pattern matching, which can consume up to 70% of system execution time [7,8], is the most important factor in overall signature-based NIDS system performance. There are two types of pattern matching algorithms: software-based and hardware-based, with the second achieving high matching speed via special-purpose devices such as field programmable gate arrays (FPGAs) [9][10][11][12][13], content addressable memory (CAM) [14,15], and application-specific integrated circuits (ASICs) [16].…”

Gnort: High Performance Network Intrusion Detection Using Graphics Processors

“…Signature matching is a highly computationally intensive process, accounting for about 75% of the total CPU processing time of modern NIDSes [2,7]. This overhead arises from the fact that most of the time, every byte of every packet needs to be processed as part of the string searching algorithm that searches for matches among a large set of strings from all signatures that apply for a particular packet.…”

A Fast and Scalable Multi-Pattern Matching Algorithm for Intrusion Detection Systems

“…Pattern matching is a time-consuming task in an NIDS. Studies have indicated that it consumes up to 70% of the system's execution time (3)(4)(5)(6) . Therefore, the pattern matching performance is crucial to an NIDS.…”