ACCELERATION OF PREPROCESSORS OF THE SNORT NETWORK INTRUSION DETECTION SYSTEM USING GENERAL PURPOSE GRAPHICS PROCESSING UNIT ( ELECTRICAL AND ELECTRONIC PROJECT TOPIC)
Abstract
Advances in networking technologies enable interactions and communications at high speeds and large data volumes. But, securing data and the infrastructure has become a big issue. Intrusion Detection Systems such as Snort play an impor-tant role to secure the network. Intrusion detection systems are used to monitor networks for unauthorized access. Snort has a packet decoder, pre-processor, de-tection engine and an alerting system. The detection engine is the most compute intensive part followed by the pre-processor. Previous work has shown how gen-eral purpose graphics processing units(GP-GPU) can be used to accellerate the detection engine. This work focused on the pre-processors of Snort, speci cally, the stream5 pre-processor as pro ling revealed it to be the most time consuming of the pre-processors. The analysis shows that the individual implementation of stream5 using Compute Uni ed Device Architecture(CUDA) achieved up to ve times speed up over the baseline. Also, an over all 15.5 percent speed up on the Defense Advanced Research Projects Agency(DARPA) intrusion detection system dataset was observed when integrated in Snort.
Chapter 1
Introduction
Nowadays, there is a rapid development of network technologies and associated bandwidth. Though these developments enhance data communication, it also facilitates malicious activities against resources on the network. These malicious threats pose challenges to modern network security systems. Many methods have been developed to secure the network infrastructure and communication over the network. Examples of widely adopted security measures on the network are the use of rewalls and data encryption. In addition to these security measures Intrusions Detection and Prevention System (IDPS) [1] is a relatively new technique.
An Intrusion Detection System (IDS) is an application that monitors the network for any unauthorized accesses into it. The application monitors the network for violation of access permissions or other malicious activities. On the other hand, an Intrusion Prevention System blocks or prevents an intrusion. IDSs can be implemented in both hardware and software. Though hardware implementations are generally faster, they su er from a couple of shortcomings that limit their usability. First, they are more expensive to implement and maintain. Second, since hardware modi cation is di cult, they are less exible for improvement. Software implementations, on the other hand, can easily be modi ed with new……..
