Abstract

Network-based intrusion detection systems (NIDSs) frequently have problems with handling heavy traffic loads in real-time, which result in packet loss and false negatives. This paper presents a high-performance network intrusion detection system, called HPMonitor, which combines a high-efficiency detection engine and a load-balancing device to address these problems. The paper describes HPMonitor's system architecture, discusses a flow-based dynamic load-balancing algorithm called dynamic least load first (DLLF) algorithm, and introduces a new multi-pattern string matching algorithm called shift max algorithm (SMA). The test results reveal that the DLLF algorithm is an effective balancing algorithm for NIDS. Meanwhile, the experimental results show that the SMA algorithm is faster in searching large sets of patterns when compared with other algorithms, and its performance is affected little when the patterns set number increases.

Keywords: Network security; Intrusion detection; High-speed network; Load balancing; Multi-pattern string matching algorithm

Article Outline

Introduction

Related works

System architecture

Dynamic load-balancing algorithm

Load function model

Evaluation

Multi-pattern string matching algorithm

Constructing automaton

Searching algorithm

Evaluation

Conclusions

Side bar

Introduction to E. Ukkonen's paper

References

Vitae