Fast Parallelized TCP/IP Stack for High-Speed Network Intrusion Detection Systems

Bin Liu
2011-01-01
Abstract:Since the speed of application layer content detection has been increased to 10 Gb/s,TCP/IP stacks have become the new bottle-neck in network intrusion detection systems.Previous systems have used 64 bit instructions,parallel instructions and kernel space memory mapping to speed up the bottle-necks,such as the TCP checksum computation,TCP connection table Hash value calculation and data copies from the kernel space to the user space.A method was developed using universal Hash in the TCP connection lookup table to avoid algorithmic complexity attacks and to speed up the computations using the parallel instructions in the SSE(streaming SIMD extensions) instruction set.A Bloom filter is used to filter TCP half-open connections.The TCP/IP stack was then parallelized using multi-loaded dynamic-link library(DLL) to achieve higher throughput.Evaluations show that a TCP/IP stack using these three processing cores is able to deliver 4.4 Gb/s throughput against attacking traffic with an average packet size of 110 Bytes and 15.2 Gb/s with normal traffic with an average packet size of 501 Bytes,which is 4 times the speed of the original system and 50%-70% higher than the authors' previous work.
What problem does this paper attempt to address?