Abstract
This research work has focussed on analysing the efficacy of the virtualization concept for Network Intrusion Detection Systems (NIDS) in the high-speed environment. We have selected an open source NIDS, Snort for evaluation. Snort has been evaluated on virtual systems built on Windows XP SP2, Linux 2.6 and Free BSD 7.1 platforms. Our results have identified a strong performance limitation of NIDS running on virtual platforms. This can be concluded that virtualization is not an ideal solution for NIDS in high-speed environments.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
References
Snort, http://www.Snort.org/
Baker, A.R., Esler, J.: Snort IDS and IPS Toolkit. Syngress, Canada (2007)
Akhlaq, M., et al.: Virtualization Efficacy for NIDS in High Speed Environments. In: Information Security and Digital Forensics Conference 2009 to be held in City University London, September 7-8 (in press, 2009)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2009 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Akhlaq, M., Alserhani, F., Awan, I.U., Cullen, A.J., Mellor, J., Mirchandani, P. (2009). Virtualization in Network Intrusion Detection Systems. In: Meersman, R., Herrero, P., Dillon, T. (eds) On the Move to Meaningful Internet Systems: OTM 2009 Workshops. OTM 2009. Lecture Notes in Computer Science, vol 5872. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-05290-3_3
Download citation
DOI: https://doi.org/10.1007/978-3-642-05290-3_3
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-05289-7
Online ISBN: 978-3-642-05290-3
eBook Packages: Computer ScienceComputer Science (R0)