Network intrusion detection using hardware techniques: A review

Abstract

-The increasing amount of network throughput and security threat makes intrusion detection a major research problem. In the literature, intrusion detection has been approached by either a hardware or software technique. This paper reviews and compares hardware based techniques that are commonly used in intrusion detection systems with a special emphasis on modern hardware platforms such as FPGA, GPU, many-core processors and ASIC. It also provides a detailed comparison between these hardware solution platforms. Our approach to classify modern hardware-based Intrusion Detection System (IDS) techniques is based on the detection approach. In addition, we provide a comparison between the classified detection approaches based on essential criteria such as definition, update process, detection ability, features of the system, and implementation requirements. Finally, a classification tree of hardware-based NIDS platforms is given.

A Comprehensive Survey of Databases and Deep Learning Methods for Cybersecurity and Intrusion Detection Systems

“…Additionally, datasets and EU standards (e.g., the General Data Protection Regulation -GDPR) for data collection and protection are addressed in this review. Other reviews considering specific aspects of this field include the work described in [27], which focuses on hardware techniques for IDS implementation; the paper presented in [28], which considers only immunity-based approaches; and the survey published in [29], which describes network security techniques for supervisory control and data acquisition systems.…”

Network Intrusion Detection Using Neural Networks on FPGA SoCs

“…Detection can be logged as an event of interest or trigger a defence mechanism to deal with the event in real-time. Mainstream IDSs use pattern matching, string matching, multi-match packet classification and regular expressions for operation [1]. These computationally complex approaches are often implemented using hardware accelerators on FPGAs or ASICs, or run on highly parallel multi-core processors or GPUs to enable them to process network traffic at the high rates required.…”

Network Based Intrusion Detection Using the UNSW-NB15 Dataset

“…Solutions for high speed deep packet inspection can be roughly divided into software solutions [7] and hardware solutions [8][9][10][11][12]. The former focus on developing optimized algorithms and data structures to represent the signatures while the latter aim at accelerating the matching process using specialized structures [10][11].…”