High-Performance Network Intrusion Detection Through Parallelism

Overview

Network intrusion detection has become increasingly popular in recent years due to the proliferation of Internet-based security attacks. Network Intrusion Detection Systems (NIDS) inspect the content of incoming packets on a network for known attacks and alert the operator when they are found. Intrusion detection is computationally expensive, and this expense limits the inspection throughput for current implementations to substantially less than the Gigabit line rate for modern CPUs. This paper presents methods for increasing NIDS performance though parallel execution using the open-source Snort NIDS, both on commodity multiprocessor systems and as part of a hardware-accelerated programmable Ethernet network interface.