Skip to main content
SpringerLink
Log in
Book cover

International Symposium on Recent Advances in Intrusion Detection

RAID 2015: Research in Attacks, Intrusions, and Defenses pp 89–110Cite as

Haetae: Scaling the Performance of Network Intrusion Detection with Many-Core Processors

  • Conference paper
  • First Online:

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 9404))

Abstract

In this paper, we present the design and implementation of Haetae, a high-performance Suricata-based NIDS on many-core processors (MCPs). Haetae achieves high performance with three design choices. First, Haetae extensively exploits high parallelism by launching NIDS engines that independently analyze the incoming flows at high speed as much as possible. Second, Haetae fully leverages programmable network interface cards to offload common packet processing tasks from regular cores. Also, Haetae minimizes redundant memory access by maintaining the packet metadata structure as small as possible. Third, Haetae dynamically offloads flows to the host-side CPU when the system experiences a high load. This dynamic flow offloading utilizes all processing power on a given system regardless of processor types. Our evaluation shows that Haetae achieves up to 79.3 Gbps for synthetic traffic or 48.5 Gbps for real packet traces. Our system outperforms the best-known GPU-based NIDS by 2.4 times and the best-performing MCP-based system by 1.7 times. In addition, Haetae is 5.8 times more power efficient than the state-of-the-art GPU-based NIDS.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

References

  1. A hash function for hash table lookup. http://www.burtleburtle.net/bob/hash/doobs.html

  2. AMD: OpenCL Zone. http://developer.amd.com/tools-and-sdks/

  3. AMD Opteron Processor Solutions. http://products.amd.com/en-gb/opteroncpuresult.aspx

  4. Check Point IP Appliances. http://www.checkfirewalls.com/IP-Overview.asp

  5. EZchip TILEncore-Gx72 Intelligent Application Adapter. http://tilera.com/products/?ezchip=588&spage=606

  6. Intel Data Direct I/O Technology. http://www.intel.com/content/www/us/en/io/direct-data-i-o.html

  7. Intel DPDK. http://dpdk.org/

  8. Kalray MPPA 256 Many-core processors. http://www.kalrayinc.com/kalray/products/#processors

  9. NVIDIA: What is GPU Computing? http://www.nvidia.com/object/what-is-gpu-computing.html

  10. PCAP. http://www.tcpdump.org/pcap.html

  11. \({\rm {PF\_RING}}\). http://www.ntop.org/products/pf_ring

  12. SnortSP (Security Platform). http://blog.snort.org/2014/12/introducing-snort-30.html

  13. Sourcefire 3D Sensors Series. http://www.ipsworks.com/3D-Sensors-Series.asp

  14. Suricata Open Source IDS/IPS/NSM engine. http://suricata-ids.org/

  15. The Intel Xeon Processor E7 v2 Family. http://www.intel.com/content/www/us/en/processors/xeon/xeon-processor-e7-family.html

  16. TILE-Gx Processor Family. http://tilera.com/products/?ezchip=585&spage=614

  17. Aho, A.V., Corasick, M.J.: Efficient string matching: an aid to bibliographic search. Commun. ACM 18(6), 333–340 (1975)

    Article  MathSciNet  MATH  Google Scholar 

  18. Baker, Z.K., Prasanna, V.K.: Time and area efficient pattern matching on FPGAs. In: Proceedings of the ACM/SIGDA International Symposium on Field-Programmable Gate Arrays (FPGA), pp. 223–232. ACM (2004)

    Google Scholar 

  19. Chen, X., Wu, Y., Xu, L., Xue, Y., Li, J.: Para-snort: A multi-thread snort on multi-core ia platform. In: Proceedings of the Parallel and Distributed Computing and Systems (PDCS) (2009)

    Google Scholar 

  20. Han, S., Jang, K., Park, K., Moon, S.: Packetshader: a gpu-accelerated software router, vol. 41, pp. 195–206 (2011)

    Google Scholar 

  21. Handley, M., Paxson, V., Kreibich, C.: Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics. In: USENIX Security Symposium, pp. 115–131 (2001)

    Google Scholar 

  22. Huang, N.F., Hung, H.W., Lai, S.H., Chu, Y.M., Tsai, W.Y.: A GPU-based multiple-pattern matching algorithm for network intrusion detection systems. In: Proceedings of the International Conference on Advanced Information Networking and Applications - Workshops (AINAW), pp. 62–67. IEEE (2008)

    Google Scholar 

  23. Jamshed, M.A., Lee, J., Moon, S., Yun, I., Kim, D., Lee, S., Yi, Y., Park, K.: Kargus: a highly-scalable software-based intrusion detection system. In: Proceedings of the ACM Conference on Computer and Communications Security (CCS), pp. 317–328 (2012)

    Google Scholar 

  24. Jiang, H., Zhang, G., Xie, G., Salamatian, K., Mathy, L.: Scalable high-performance parallel design for network intrusion detection systems on many-core processors. In: Proceedings of the ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS). IEEE Press (2013)

    Google Scholar 

  25. Kuon, I., Tessier, R., Rose, J.: FPGA architecture: Survey and challenges. In: Foundations and Trends in Electronic Design Automation, vol. 2, pp. 135–253. Now Publishers Inc. (2008)

    Google Scholar 

  26. Meiners, C.R., Patel, J., Norige, E., Torng, E., Liu, A.X.: Fast regular expression matching using small TCAMs for network intrusion detection and prevention systems. In: Proceedings of the 19th USENIX conference on Security, pp. 8–8. USENIX Association (2010)

    Google Scholar 

  27. Mitra, A., Najjar, W., Bhuyan, L.: Compiling PCRE to FPGA for accelerating Snort IDS. In: Proceedings of the ACM/IEEE Symposium on Architecture for Networking and Communications Systems (ANCS), pp. 127–136. ACM (2007)

    Google Scholar 

  28. Rizzo, L.: netmap: a novel framework for fast packet i/o. In: USENIX Annual Technical Conference. pp. 101–112 (2012)

    Google Scholar 

  29. Roesch, M., et al.: Snort - lightweight intrusion detection for networks. In: Proceedings of the USENIX Systems Administration Conference (LISA) (1999)

    Google Scholar 

  30. Smith, R., Estan, C., Jha, S., Kong, S.: Deflating the big bang: fast and scalable deep packet inspection with extended finite automata. ACM SIGCOMM Comput. Commun. Rev. 38, 207–218 (2008)

    Article  Google Scholar 

  31. Smith, R., Goyal, N., Ormont, J., Sankaralingam, K., Estan, C.: Evaluating gpus for network packet signature matching. In: Proceedings of the IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS) (2009)

    Google Scholar 

  32. Tan, L., Sherwood, T.: A high throughput string matching architecture for intrusion detection and prevention. In: ACM SIGARCH Computer Architecture News, vol. 33, pp. 112–122. IEEE Computer Society (2005)

    Google Scholar 

  33. Vasiliadis, G., Antonatos, S., Polychronakis, M., Markatos, E.P., Ioannidis, S.: Gnort: high performance network intrusion detection using graphics processors. In: Lippmann, R., Kirda, E., Trachtenberg, A. (eds.) RAID 2008. LNCS, vol. 5230, pp. 116–134. Springer, Heidelberg (2008)

    Chapter  Google Scholar 

  34. Vasiliadis, G., Polychronakis, M., Ioannidis, S.: Midea: a multi-parallel intrusion detection architecture. In: Proceedings of the ACM Conference on Computer and Communications Security (CCS), pp. 297–308 (2011)

    Google Scholar 

  35. Woo, S., Jeong, E., Park, S., Lee, J., Ihm, S., Park, K.: Comparison of caching strategies in modern cellular backhaul networks. In:Proceeding of the Annual International Conference on Mobile Systems, Applications, and Services (MobiSys), pp. 319–332. ACM (2013)

    Google Scholar 

  36. Yu, F., Katz, R.H., Lakshman, T.V.: Gigabit rate packet pattern-matching using tcam. In: Proceedings of the IEEE International Conference on Network Protocols(ICNP), pp. 174–183. IEEE (2004)

    Google Scholar 

Download references

Acknowledgments

We thank anonymous reviewers of RAID 2015 for their insightful comments on our paper. This research was supported in part by SK Telecom [G01130271, Research on IDS/IPS with many core NICs], and by the ICT R&D programs of MSIP/IITP, Republic of Korea [14-911-05-001, Development of an NFV-inspired networked switch and an operating system for multi-middlebox services], [R0190-15-2012, High Performance Big Data Analytics Platform Performance Acceleration Technologies Development].

Author information

Authors and Affiliations

  1. School of Computing, KAIST, Daejeon, South Korea

    Jaehyun Nam

  2. Department of Electrical Engineering, KAIST, Daejeon, South Korea

    Muhammad Jamshed, Byungkwon Choi, Dongsu Han & KyoungSoo Park

Authors
  1. Jaehyun Nam
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Muhammad Jamshed
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Byungkwon Choi
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Dongsu Han
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. KyoungSoo Park
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Jaehyun Nam .

Editor information

Editors and Affiliations

  1. Vrije Universiteit Amsterdam, Amsterdam, Noord-Holland, The Netherlands

    Herbert Bos

  2. University of North Carolina at Chapel H, Chapel-Hill, USA

    Fabian Monrose

  3. Université Paris-Saclay, Evry, France

    Gregory Blanc

Rights and permissions

Reprints and permissions

Copyright information

© 2015 Springer International Publishing Switzerland

About this paper

Cite this paper

Nam, J., Jamshed, M., Choi, B., Han, D., Park, K. (2015). Haetae: Scaling the Performance of Network Intrusion Detection with Many-Core Processors. In: Bos, H., Monrose, F., Blanc, G. (eds) Research in Attacks, Intrusions, and Defenses. RAID 2015. Lecture Notes in Computer Science(), vol 9404. Springer, Cham. https://doi.org/10.1007/978-3-319-26362-5_5

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-26362-5_5

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-26361-8

  • Online ISBN: 978-3-319-26362-5

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation