Offloading IDS Computation to the GPU

Jacob, Noby K.; Brodley, Carla E.

doi:10.1109/acsac.2006.35

Cited by 62 publications

(41 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, Scarpazza et al [10], [11] port the deterministic finite automata version of the Aho-Corasick method to the IBM Cell Broadband Engine (CBE) while Zha et al [16] port a compressed form of the non-deterministic finite automata version of the Aho-Corasick method to the CBE. Jacob et al [5] port Snort to a GPU. However, in their port, they replace the Aho-Corasick search method employed by Snort with the Knuth-Morris-Pratt [6] single-pattern matching algorithm.…”

Section: Introductionmentioning

confidence: 99%

Multipattern string matching on a GPU

Zha

Sahni

2011

2011 IEEE Symposium on Computers and Communications (ISCC)

View full text Add to dashboard Cite

Abstract-We develop GPU adaptations of the Aho-Corasick string matching algorithm for the two cases GPU-to-GPU and host-to-host. For the GPU-to-GPU case, we consider several refinements to a base GPU implementation and measure the performance gain from each refinement. For the host-to-host case, we analyze two strategies to communicate between the host and the GPU and show that one is optimal with respect to run time while the other requires less device memory. Experiments conducted on an NVIDIA Tesla GT200 GPU that has 240 cores running off of a Xeon 2.8GHz quad-core host CPU show that, for the GPU-to-GPU case, our Aho-Corasick GPU adaptation achieves a speedup between 8.5 and 9.5 relative to a singlethread CPU implementation and between 2.4 and 3.2 relative to the best multithreaded implementation. For the host-to-host case, the GPU AC code achieves a speedup of 3.1 relative to a singlethreaded CPU implementation. However, the GPU is unable to deliver any speedup relative to the best multithreaded code running on the quad-core host. In fact, the measured speedups for the latter case ranged between 0.74 and 0.83.

show abstract

Section: Introductionmentioning

confidence: 99%

Multipattern string matching on a GPU

Zha

Sahni

2011

2011 IEEE Symposium on Computers and Communications (ISCC)

View full text Add to dashboard Cite

show abstract

“…This can be explained by the fact that as the CPU controls the execution of the GPU, by overloading the former the execution flow is affected directly. However, performance degradation did not converge to that of default Snort, in contrast with [17].…”

Section: Macrobenchmarksmentioning

confidence: 94%

“…The work most related to ours is PixelSnort [17]. It is a port of the Snort IDS that offloads packet matching to an NVIDIA 6800GT.…”

Section: Overview Of the Geforce 8 Series Architecturementioning

confidence: 99%

“…Specifically, it has been shown that GPU support can substantially increase the performance of digital forensics software that relies on binary string searches [20]. Jacob and Brodley were the first that tried to use the GPU as a pattern matching engine for NIDS in PixelSnort [17]. They used a simplified version of the Knuth-Morris-Pratt (KMP) algorithm [18], however, their performance results indicated marginal improvement.…”

Section: Introductionmentioning

confidence: 99%

“…In addition, many attempts have been made to use graphics processors for security purposes, including cryptography [11], data carving [20] and intrusion detection [17]. Specifically, it has been shown that GPU support can substantially increase the performance of digital forensics software that relies on binary string searches [20].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Gnort: High Performance Network Intrusion Detection Using Graphics Processors

Vasiliadis

Antonatos

Polychronakis

et al.

Lecture Notes in Computer Science

252

158

View full text Add to dashboard Cite

Abstract. The constant increase in link speeds and number of threats poses challenges to network intrusion detection systems (NIDS), which must cope with higher traffic throughput and perform even more complex per-packet processing. In this paper, we present an intrusion detection system based on the Snort open-source NIDS that exploits the underutilized computational power of modern graphics cards to offload the costly pattern matching operations from the CPU, and thus increase the overall processing throughput. Our prototype system, called Gnort, achieved a maximum traffic processing throughput of 2.3 Gbit/s using synthetic network traces, while when monitoring real traffic using a commodity Ethernet interface, it outperformed unmodified Snort by a factor of two. The results suggest that modern graphics cards can be used effectively to speed up intrusion detection systems, as well as other systems that involve pattern matching operations.

show abstract

An efficient parallel algorithm for exact multi‐pattern matching

Zhang

Tian

et al. 2014

Security Comm Networks

View full text Add to dashboard Cite

This paper presents a parallel algorithm Parallel Extended Bloom Filter (PEBF) for exact multi‐pattern matching based on Bloom filter. To improve the throughput and parallelism of the algorithm, we divided the pattern set into N subsets where the length of patterns is the same, and different subsets would not intersect each other. We construct an EBF for each subset and use N threads to simultaneously process the subsets in parallel. We implement our solution on the graphics processing unit, called G‐PEBF. Experimental results demonstrate that PEBF performs better than the Wu–Manber (WM) algorithm in terms of time and space. And G‐PEBF outperforms the G‐WM (WM algorithm implemented on graphics processing unit). The speedup of G‐PEBF is up to 60 times at peak performance and almost 10 times at worst performance to the PEBF algorithm. Copyright © 2014 John Wiley & Sons, Ltd.

show abstract

Offloading IDS Computation to the GPU

Cited by 62 publications

References 15 publications

Multipattern string matching on a GPU

Multipattern string matching on a GPU

Gnort: High Performance Network Intrusion Detection Using Graphics Processors

An efficient parallel algorithm for exact multi‐pattern matching

Contact Info

Product

Resources

About