Abstract:Intrusion Prevention Systems (IPS), capable of preventing the organizational network from a cyber-attack in addition to detecting it, are widely adopted by organizations to protect their networks from unauthorized access, attacks, and malicious activities. Similarly, Snort an open-source IPS is extensively used for effective network security monitoring and analysis. When functioning as an IPS, Snort can be deployed in inline mode within an organizational network, so that all the organizational network traffic travels through it, hence actively blocking or preventing malicious traffic in real-time. This requires Snort to process the network traffic fast enough to match the network traffic line rate. But the Snort IPS default data acquisition module i.e. advanced packet filtering (AF_PACKET) cannot process network traffic at the line rate that causes packet loss and network services disturbance. This research work discusses the technologies available to make Snort IPS process network traffic at line rate. Packet filtering framework (PF_RING) and data plane development kit (DPDK) are the most effective and widely used software technologies, whereas the Napatech smart network interface card (smartNIC) is a very efficient hardware technology for achieving line rate traffic processing. A throughput comparison shows that PF_RING and DPDK achieve a throughput close to 1G with 100% CPU utilization whereas Napatech smartNIC achieves full 1G throughput with CPU utilization of less than 5%. Furthermore, the integration of Snort IPS with the security information and event management (SIEM) system has been discussed for better attack detection in an organizational network.

Packet header parsing method in high speed network intrusion detection system

Intrusion Detection And Simulation For High-Speed Networks

Embedded network processor based parallel intrusion detection

Hybrid Intrusion Detection System for Complicated Network

Multi-Gigabit Rate Pattern-Matching Engine Using Grouping CAM/TCAM

A Parallel Intrusion Detection System for High-Speed Networks

Traffic Distributor for High-Speed Network Intrusion Detection System

High-Speed Memory-Efficient Network Intrusion Detection System

The Design of a Dynamic Configurable Packet Parser Based on FPGA

Research on a High-Performance Intrusion Detecition Communication- Mechanismsupporting SMP

New Trend of Intrusion Detection System for High-speed Networks

Specified Hardware for Network Frames Analysis

Towards High-Performance Network Intrusion Prevention System on Multi-core Network Services Processor

Research and Implementation of High-Speed Packet Processing in Gigabit Network IPS

Fast Parallelized TCP/IP Stack for High-Speed Network Intrusion Detection Systems

A high throughput Intrusion Detection System (IDS) to enhance the security of data transmission among research centers

A high-performance network monitoring platform for intrusion detection

Techniques of Building a Scalable, Efficient Intrusion Monitoring Architecture

A Memory-Efficient Parallel String Matching Architecture for High-Speed Intrusion Detection

Design and Implementation of Network Intrusion Prevention System Based on High-Speed Network Processor

Advancing Snort IPS to Achieve Line Rate Traffic Processing for Effective Network Security Monitoring