Abstract:The main problem existed in the Network-based Intrusion Detection System (NIDS) is that the data-processing ability of classical centralized intrusion detection architecture does dissatisfy the increasing requirement of high-speed network. To resolve this problem, especially in real-time online intrusion detection, a NIDS cluster scheme is firstly introduced in this paper. Secondly, given the high resource demands and the special load-balancing characteristics in NIDS cluster, three optimized polices to improve the performance of NIDS cluster are proposed, i.e. Early Simple Packet Filter (ESPF), Adaptive Hash Load-Balancing (AHLB) algorithm, Priority Scheduling with Buffer Limited (PSBL). All the optimized measures are in collaboration with one another and provide the NIDS cluster scalability, adaptability, and high performance. Moreover, with the goal of analyzing the performance of NIDS cluster a Stochastic Petri Net (SPN) model is proposed. To cope with the well-known state space explosion problem, we propose an approximate analysis technique, which can significantly reduce the computing complexity of the model. In the end, the numerical results of the performance analysis for those schemes are presented, and some valuable conclusions are recommended which are suitable for NIDS cluster to achieve high performance.

Improving the performance of NIDS using symmetric multi-processor

Embedded network processor based parallel intrusion detection

Multi-Gigabit Rate Pattern-Matching Engine Using Grouping CAM/TCAM

Towards High-Performance Network Intrusion Prevention System on Multi-core Network Services Processor

A Parallel Intrusion Detection System for High-Speed Networks

Intrusion Detection And Simulation For High-Speed Networks

Para-snort : a multi-thread snort on multi-core ia platform

A Parallel Nids Pattern Matching Engine and Its Implementation on Network Processor

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

A Framework For Performance Evaluation Of ASIPS In Network-Based IDS

High-Speed Memory-Efficient Network Intrusion Detection System

Real-time intrusion detection for high-speed networks

Modeling and Performance Analysis of Network-Based Intrusion Detection Cluster

Practical Performance of a Distributed Processing Framework for Machine-Learning-based NIDS

Traffic Distributor for High-Speed Network Intrusion Detection System

Optimizing multi-thread string matching for network processor based intrusion management system

Load Balancing Algorithm for High-Speed Network Intrusion Detection Systems

New Trend of Intrusion Detection System for High-speed Networks

Simd Massively Parallel Processing System For Real-Time Image Processing

A Memory-Efficient Parallel String Matching Architecture for High-Speed Intrusion Detection

A Fast Multi-pattern Matching Algorithm for Deep Packet Inspection on a Network Processor