TY - GEN
T1 - Gnort
T2 - Recent Advances in Intrusion Detection - 11th International Symposium, RAID 2008, Proceedings
AU - Vasiliadis, Giorgos
AU - Antonatos, Spiros
AU - Polychronakis, Michalis
AU - Markatos, Evangelos P.
AU - Ioannidis, Sotiris
PY - 2008
Y1 - 2008
N2 - The constant increase in link speeds and number of threats poses challenges to network intrusion detection systems (NIDS), which must cope with higher traffic throughput and perform even more complex per-packet processing. In this paper, we present an intrusion detection system based on the Snort open-source NIDS that exploits the underutilized computational power of modern graphics cards to offload the costly pattern matching operations from the CPU, and thus increase the overall processing throughput. Our prototype system, called Gnort, achieved a maximum traffic processing throughput of 2.3 Gbit/s using synthetic network traces, while when monitoring real traffic using a commodity Ethernet interface, it outperformed unmodified Snort by a factor of two. The results suggest that modern graphics cards can be used effectively to speed up intrusion detection systems, as well as other systems that involve pattern matching operations.
AB - The constant increase in link speeds and number of threats poses challenges to network intrusion detection systems (NIDS), which must cope with higher traffic throughput and perform even more complex per-packet processing. In this paper, we present an intrusion detection system based on the Snort open-source NIDS that exploits the underutilized computational power of modern graphics cards to offload the costly pattern matching operations from the CPU, and thus increase the overall processing throughput. Our prototype system, called Gnort, achieved a maximum traffic processing throughput of 2.3 Gbit/s using synthetic network traces, while when monitoring real traffic using a commodity Ethernet interface, it outperformed unmodified Snort by a factor of two. The results suggest that modern graphics cards can be used effectively to speed up intrusion detection systems, as well as other systems that involve pattern matching operations.
KW - GPU
KW - Intrusion detection systems
KW - Network security
KW - Parallel programming
KW - Pattern matching
KW - SIMD
UR - https://www.scopus.com/pages/publications/56549099368
U2 - 10.1007/978-3-540-87403-4_7
DO - 10.1007/978-3-540-87403-4_7
M3 - Conference contribution
AN - SCOPUS:56549099368
SN - 354087402X
SN - 9783540874027
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 116
EP - 134
BT - Recent Advances in Intrusion Detection - 11th International Symposium, RAID 2008, Proceedings
PB - Springer Verlag
Y2 - 15 September 2008 through 17 September 2008
ER -