Abstract:Intrusion Prevention Systems (IPS), capable of preventing the organizational network from a cyber-attack in addition to detecting it, are widely adopted by organizations to protect their networks from unauthorized access, attacks, and malicious activities. Similarly, Snort an open-source IPS is extensively used for effective network security monitoring and analysis. When functioning as an IPS, Snort can be deployed in inline mode within an organizational network, so that all the organizational network traffic travels through it, hence actively blocking or preventing malicious traffic in real-time. This requires Snort to process the network traffic fast enough to match the network traffic line rate. But the Snort IPS default data acquisition module i.e. advanced packet filtering (AF_PACKET) cannot process network traffic at the line rate that causes packet loss and network services disturbance. This research work discusses the technologies available to make Snort IPS process network traffic at line rate. Packet filtering framework (PF_RING) and data plane development kit (DPDK) are the most effective and widely used software technologies, whereas the Napatech smart network interface card (smartNIC) is a very efficient hardware technology for achieving line rate traffic processing. A throughput comparison shows that PF_RING and DPDK achieve a throughput close to 1G with 100% CPU utilization whereas Napatech smartNIC achieves full 1G throughput with CPU utilization of less than 5%. Furthermore, the integration of Snort IPS with the security information and event management (SIEM) system has been discussed for better attack detection in an organizational network.

Design and Implementation of Network Intrusion Prevention System Based on High-Speed Network Processor

Embedded network processor based parallel intrusion detection

Implementation of Network Processor-Based Content Filtering

Towards High-Performance Network Intrusion Prevention System on Multi-core Network Services Processor

Intrusion Detection And Simulation For High-Speed Networks

Research of Distributed Pre-Decision Engine in Wireless Intrusion Prevention Systems

Research on Distributed Intrusion Prevention System on High-Speed Networks

Hybrid Intrusion Detection System for Complicated Network

Traffic Distributor for High-Speed Network Intrusion Detection System

Fastpath-based VPN Gateway over Network Processor

Design and Implementation of a Gigabit Rate Network Intrusion Prevention System

Research and Implementation of High-Speed Packet Processing in Gigabit Network IPS

A Parallel Intrusion Detection System for High-Speed Networks

New Trend of Intrusion Detection System for High-speed Networks

Design of a high performance network security processor

Improving the performance of NIDS using symmetric multi-processor

Design of Traffic Distributor Based on IXP1200 for Network Intrusion Detection System

A Framework For Performance Evaluation Of ASIPS In Network-Based IDS

Design and Implementation of Kilomega Wirespeed Intrusion Detect System

Advancing Snort IPS to Achieve Line Rate Traffic Processing for Effective Network Security Monitoring

A 10 Gbps In-Line Network Security Processor Based on Configurable Hetero-Multi-cores