Publication Details

Increasing Throughput of Intrusion Detection Systems by Hash-Based Short String Pre-Filter

FUKAČ Tomáš, KOŠAŘ Vlastimil, KOŘENEK Jan and MATOUŠEK Jiří. Increasing Throughput of Intrusion Detection Systems by Hash-Based Short String Pre-Filter. In: Proceedings - Conference on Local Computer Networks, LCN. Sydney (virtual): Institute of Electrical and Electronics Engineers, 2020, pp. 509-514. ISBN 978-1-7281-7158-6.
Czech title
Zvýšování propustnosti systémů IDS pomocí prefiltrace založení na hashovacích funkcích
Type
conference paper
Language
english
Authors
Keywords

regular expressions, network traffic filtration, hash-based short string prefilter, IDS, network security systems, field programmable gate arrays

Abstract

With an increasing speed of network links, it is also necessary to increase the throughput of network security systems. An intrusion detection system (IDS) is one of the key components in the protection of network infrastructure. Unfortunately, the IDS has to match a large set of regular expressions (REs) in network streams, which has a negative impact on its throughput. Currently, multiple parallel machines have to be used to support 100 Gbps throughput of Suricata or Bro IDS.
A fast pre-filtration of network traffic can allow the IDS to achieve a higher overall throughput. Therefore, we have designed a new algorithm, which is able to select a set of short strings that represents an RE set utilized in the IDS. Such a set of strings can facilitate fast and efficient pre-filtration. Compared to previous methods, strings selected by the proposed algorithm can reduce network traffic up to 3.3 times better. Moreover, the algorithm is able to select strings representing a single RE in less than a second, thus  allowing fast updates of an IDS ruleset. As all selected strings have the same length, they can be used in a hash-based pre-filter, which is able to process more 100 Gbps of network traffic.

Published
2020
Pages
509-514
Proceedings
Proceedings - Conference on Local Computer Networks, LCN
Conference
The 45th IEEE Conference on Local Computer Networks, Sydney (virtual), AU
ISBN
978-1-7281-7158-6
Publisher
Institute of Electrical and Electronics Engineers
Place
Sydney (virtual), AU
DOI
UT WoS
000674915500075
EID Scopus
BibTeX
@INPROCEEDINGS{FITPUB12338,
   author = "Tom\'{a}\v{s} Fuka\v{c} and Vlastimil Ko\v{s}a\v{r} and Jan Ko\v{r}enek and Ji\v{r}\'{i} Matou\v{s}ek",
   title = "Increasing Throughput of Intrusion Detection Systems by Hash-Based Short String Pre-Filter",
   pages = "509--514",
   booktitle = "Proceedings - Conference on Local Computer Networks, LCN",
   year = 2020,
   location = "Sydney (virtual), AU",
   publisher = "Institute of Electrical and Electronics Engineers",
   ISBN = "978-1-7281-7158-6",
   doi = "10.1109/LCN48667.2020.9314812",
   language = "english",
   url = "https://www.fit.vut.cz/research/publication/12338"
}
Back to top