An architecture for exploiting multi-core processors to parallelize network intrusion prevention

Authors:
Robin Sommer;Vern Paxson;Nicholas Weaver
Affiliations:
International Computer Science Institute, Berkeley, CA, U.S.A. and Lawrence Berkeley National Laboratory, Berkeley, CA, U.S.A.;International Computer Science Institute, Berkeley, CA, U.S.A. and UC Berkeley, Berkeley, CA, U.S.A.;International Computer Science Institute, Berkeley, CA, U.S.A.
Venue:
Concurrency and Computation: Practice & Experience - Multi-core Supported Network and System Security
Year:
2009

Citing 0
Cited 8

Packet scheduling for deep packet inspection on multi-core architectures

Proceedings of the 6th ACM/IEEE Symposium on Architectures for Networking and Communications Systems
Network-wide deployment of intrusion detection and prevention systems

Proceedings of the 6th International COnference
Improving the performance of passive network monitoring applications with memory locality enhancements

Computer Communications
MCA2: multi-core architecture for mitigating complexity attacks

Proceedings of the eighth ACM/IEEE symposium on Architectures for networking and communications systems
Re-examining the performance bottleneck in a NIDS with detailed profiling

Journal of Network and Computer Applications
Scalanytics: a declarative multi-core platform for scalable composable traffic analytics

Proceedings of the 22nd international symposium on High-performance parallel and distributed computing
Comparison of caching strategies in modern cellular backhaul networks

Proceeding of the 11th annual international conference on Mobile systems, applications, and services
Scap: stream-oriented network traffic capture and analysis for high-speed networks

Proceedings of the 2013 conference on Internet measurement conference

Quantified Score

Hi-index	0.00

Visualization

Abstract

It is becoming increasingly difficult to implement effective systems for preventing network attacks, due to the combination of the rising sophistication of attacks requiring more complex analyses to detect; the relentless growth in the volume of network traffic that we must analyze; and, critically, the failure in recent years for uniprocessor performance to sustain the exponential gains that for so many years CPUs have enjoyed. For commodity hardware, tomorrow's performance gains will instead come from multi-core architectures in which a whole set of CPUs executes concurrently. Taking advantage of the full power of multi-core processors for network intrusion prevention requires an in-depth approach. In this work we frame an architecture customized for parallel execution of network attack analysis. At the lowest layer of the architecture is an ‘Active Network Interface’, a custom device based on an inexpensive FPGA platform. The analysis itself is structured as an event-based system, which allows us to find many opportunities for concurrent execution, since events introduce a natural asynchrony into the analysis while still maintaining good cache locality. A preliminary evaluation demonstrates the potential of this architecture. Copyright © 2009 John Wiley & Sons, Ltd.