Design and Implementation of a Stateful High Speed Intrusion Detection System
Date Issued
2006
Date
2006
Author(s)
Chung, Chia-Fang
DOI
en-US
Abstract
As technologies are greatly advanced, more and more individuals and companies rely on Internet for communication and business. However, with the continuous disclosure of vulnerabilities associated with computers and network systems, network security has become an increasing important issue. Intrusion Detection System (IDS) plays an important role in addressing these security problems by providing timely identification of potential attacks and effective responses.
Among IDSs currently available, rule-based technique is most popular due to the convenience in inserting or modifying rules incrementally for newly discovered intrusions. However, traditional IDS used a stateless approach in which network traffic is inspected packet by packet and compared with numerous rules to identify possible attacks. With the growing popularity and variety of intrusions, these simple pattern-matching techniques may not be sufficient to detect sophisticated attacks.
Thus, we consider that there is a need to develop a stateful IDS for high speed network. We adopt the idea of stateful inspection that continuously inspects content of packets with memory of related ones and maintains the current “state” information to detect and analyze intrusions in an integrated way. Besides stateful TCP inspection, we also provide application layer stateful inspection to understand the complete network behavior. Moreover, we thoroughly study on multi-staged event correlation and proposed an approach to fully realize and effectively detect multi-stage attacks. Furthermore, we implement the prototype system on a System-on-a-Chip (SoC) and offload CPU-intensive string matching function to the FPGA based hardware component to boost the performance. Through intensive evaluations, our designed IDS is shown outperforming snort in terms of effective and efficiency.
Subjects
狀態化
入侵偵測
事件關聯
多步驟攻擊
Stateful
IDS
Event Correlation
Multi-stage Attack
Type
other
File(s)![Thumbnail Image]()
Loading...
Name
ntu-95-R93725010-1.pdf
Size
23.31 KB
Format
Adobe PDF
Checksum
(MD5):d530aaf15d70054447b3d3754fdee3c1