The Design and Implementation of a Multi-core Supported Network Intrusion Detection System

Bo-Ting Chen ； Yu-Lun Huang

《全國資訊安全會議》 第20屆 (2010/05) Pp. 175-180

https://doi.org/10.29615/CISC.201005.0175

並列摘要

The modern multi-core technologies help improve the performance of multi-threaded NIDSes. The existing designs intend to use one dedicated thread to capture packets and execute multiple threads to inspect packets. Most of the existing designs are realized by invoking functions in libpcap to capture packets. Since libpcap does not allocate new memory spaces for the new coming packets, memory copies are required to store these packets to the buffers shared among threads. The extra copies then result in a degraded performance. In this paper, we propose a copy-free multi-threaded NIDS, mNIDS, to get better efficiency on a multi-core platform. mNIDS supports multiple threads for simultaneous packet capture and inspection, such a design eliminate the requirement of memory copies when passing packets among threads. To prevent threads from receiving duplicate packets, we adopt packet filters running in kernel space to distribute packets among threads. In this research, we implement mNIDS on a quad-core platform and conduct a series of experiments to compare its performance with Intel's multi-threaded NIDS. The experiment results show that mNIDS has an improvement of performance by a factor of 3, for the case that analyzes a trace file using about 10,000 pattern rules. Even when processing a trace that most traffic are analyzed by a certain thread, mNIDS still remains at least 13% decrease on execution time.