An Efficient Pre-Filtering Mechanism for Parallel Intrusion Detection Based on Many-Core Gpu

Chengkun Wu,Jianping Yin,Zhiping Cai,En Zhu,Jieren Cheng
DOI: https://doi.org/10.1007/978-3-642-10847-1_37
2009-01-01
Abstract:Multi-pattern search is a time-consuming task in Network Intrusion Detection Systems(NIDS). The processing ability of NIDS cannot catch up with the rapid development of network bandwidth. One intuitive idea is to use pre-filtering to reduce the workload of NIDS. Our goal is to design a novel method for per-filtering which will be ready for an efficient implementation on many-core GPU. Through statistical analysis, we propose a rudimentary method to use 2B ASCII sub patterns as the filter keywords. To reduce the size of the filter keyword set, we use Binary Integer Linear Programming(BILP) for optimization. The number of filter keywords is reduced from 4824 to 362, which is also much smaller then the prefix based and suffix based method. We argue that our method can well utilize the computation power of GPU. Experiments demonstrate that our pre-filter can achieve a good fiter ratio, thus alleviate the burden of NIDS.
What problem does this paper attempt to address?