Abstract:The rapid evolution of technology has fostered an exponential rise in the number of individuals and devices interconnected via the Internet. This interconnectedness has prompted companies to expand their computing and communication infrastructures significantly to accommodate the escalating demands. However, this proliferation of connectivity has also opened new avenues for cyber threats, emphasizing the critical need for Intrusion Detection Systems (IDSs) to adapt and operate efficiently in this evolving landscape. In response, companies are increasingly seeking IDSs characterized by horizontal, modular, and elastic attributes, capable of dynamically scaling with the fluctuating volume of network data flows deemed essential for effective monitoring and threat detection. Yet, the task extends beyond mere data capture and storage; robust IDSs must integrate sophisticated components for data analysis and anomaly detection, ideally functioning in real-time or near real-time. While Machine Learning (ML) techniques present promising avenues for detecting and mitigating malicious activities, their efficacy hinges on the availability of high-quality training datasets, which in turn poses a significant challenge. This paper proposes a comprehensive solution in the form of an architecture and reference implementation for (near) real-time capture, storage, and analysis of network data within a 1 Gbps network environment. Performance benchmarks provided offer valuable insights for prototype optimization, demonstrating the capability of the proposed IDS architecture to meet objectives even under realistic operational scenarios.

An IDS-Supported Architecture of Information Capture for High-Speed Networks

Intrusion Detection And Simulation For High-Speed Networks

Hybrid Intrusion Detection System for Complicated Network

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

Research on High-Speed Network Data Stream Capture Based on Multi-Queue NIC and Multi-Core Processor

Realtime Capture of High-Speed Traffic on Multi-Core Platform

Traffic Distributor for High-Speed Network Intrusion Detection System

New Trend of Intrusion Detection System for High-speed Networks

High-speed data capture technology based on dynamic memory pool and WinpCap

Design of Advanced IDS Architecture for Electricity Information Networks

A High-Speed Real-Time HTTP Performance Measurement Architecture Based on Network Processor

High-Speed Memory-Efficient Network Intrusion Detection System

Parameterization and Performance Analysis of a Scalable, near Real-Time Packet Capturing Platform

A Parallel Intrusion Detection System for High-Speed Networks

Techniques of Building a Scalable, Efficient Intrusion Monitoring Architecture

Network Traffic Analysis System Based on IPFIX

Packet header parsing method in high speed network intrusion detection system

Novel traffic measurement architecture for high-speed IP network

BCAM-based Stateless High-Speed Imperceptible Packet Capture System

High Speed Traffic Archiving System For Flow Granularity Storage And Querying