Gnort: High performance network intrusion detection using graphics processors. The constant increase in link speeds and number of threats poses challenges to network intrusion detection systems (NIDS), which must cope with higher traffic throughput and perform even more complex per-packet processing. In this paper, we present an intrusion detection system based on the Snort open-source NIDS that exploits the underutilized computational power of modern graphics cards to offload the costly pattern matching operations from the CPU, and thus increase the overall processing throughput. Our prototype system, called Gnort, achieved a maximum traffic processing throughput of 2.3 Gbit/s using synthetic network traces, while when monitoring real traffic using a commodity Ethernet interface, it outperformed unmodified Snort by a factor of two. The results suggest that modern graphics cards can be used effectively to speed up intrusion detection systems, as well as other systems that involve pattern matching operations.
Keywords for this software
References in zbMATH (referenced in 4 articles )
Showing results 1 to 4 of 4.
- Scarpazza, Daniele Paolo: Top-performance tokenization and small-ruleset regular expression matching. A quantitative performance analysis and optimization study on the Cell/B.E. processor (2011)
- Zhu, Quanyan; Başar, Tamer: Indices of power in optimal IDS default configuration: theory and examples (2011)
- Wu, Chengkun; Yin, Jianping; Cai, Zhiping; Zhu, En; Cheng, Jieren: An efficient pre-filtering mechanism for parallel intrusion detection based on many-core GPU (2010)
- Vasiliadis, Giorgos; Antonatos, Spiros; Polychronakis, Michalis; Markatos, Evangelos P.; Ioannidis, Sotiris: Gnort: High performance network intrusion detection using graphics processors (2008)