方案实现(JSQ需要保证同一个流)_第1页
方案实现(JSQ需要保证同一个流)_第2页
方案实现(JSQ需要保证同一个流)_第3页
方案实现(JSQ需要保证同一个流)_第4页
方案实现(JSQ需要保证同一个流)_第5页
已阅读5页,还剩16页未读 继续免费阅读

下载本文档

版权说明:本文档由用户提供并上传,收益归属内容提供方,若内容存在侵权,请进行举报或认领

文档简介

1、Para-Snort : A Multi-thread Snort on Multi-Core IA PlatformTsinghua UniversityPDCS 2021November 3, 2021Xinming Chen, Yiyao Wu, Lianghong Xu, Yibo Xue and Jun LiOutlineIntroduction of NIDS on IASome previous workStructure of our system, whats different? Detailed module designBreaking the bottlenecksP

2、ara-Snort PerformanceConclusions2NIDS on IA platformNIDS(Network Intrusion Detection System) looks into both header and payload of packets to identify intrusionWhy on IA platform?low priceeasily to developflexibility on structure and rulesetBut not so fast as ASICs or FPGA! 3The structure of NIDSSno

3、rt by Sourcefire Inc.The most popular open source NIDS on IA platformPreprocess and Detect cost most computation power 4Way to speed up?Multicore IA platformLeads the trends of higher processor computation powerNeed parallel structure of the software Rarely leveraged in existing NIDSTwo previous wor

4、k: Supra-linear and MultiSnort5Supra-linear Packet ProcessingIntel Co. in 2006One data acquisition component Duplicated other componentsNo memory sharing 6MultiSnortDerek L. Schuff, Purdue University.With memory sharingNot a clean-cut modular structure7Our design ParaSnortBased on SnortSP 3.0, a new

5、 different branchModular designMultifunction processing modulesMemory sharingOptimization on core algorithms Sufficient speedup8Detailed module designData Sourcedata acquisition and decoder Load Balancedispatches traffic and makes multi-staged processingProcessing Moduleeach is a single threadprepro

6、cessors and detection engineeasy to develop functions other than intrusion detection, such as antivirus or URL filtering Output moduleGenerate alert9Optimize Load BalancingSnortSP 3.0 provides IP hash algorithmNot so balance when there are few flowsThree improve methods: 5-tuple hashJoin the Shortes

7、t QueueModified-JSQReassign a flow when it has silenced for a long time10Optimize Multi-pattern MatchingSnortSP 3.0 provides AC algorithmAC works fast, and when there are few matches, the cache locality is high.But when there are many matches in the traffic, the cache locality turns bad.We introduce

8、d AC-WM to reduce the size of the state machines of compiled ruleset.While costs much less memory, AC-WM is a bit slower than AC for ordinary traffics, so users can decide which to use according to their network environment.11Para-Snort Performance12The SetupFor tcpdump tracesFor real traffictwo qua

9、d-core Xeon E5335 at 2.00GHz4 GB DRAMUbuntu 8.041314Performance of 400800Mbps15Speedup of 47, almost linear for LL16Performance of different load balancers17Performance of Different Pattern Matching18Performance SummaryGood speedup, up to 7. Performance up to 800MbpsM-JSQ is fastestAC-WM costs less memory, but slower19ConclusionsMulti-thread design fully utilizes multi-core CPUModular design, multifunction process modules, ea

温馨提示

  • 1. 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。图纸软件为CAD,CAXA,PROE,UG,SolidWorks等.压缩文件请下载最新的WinRAR软件解压。
  • 2. 本站的文档不包含任何第三方提供的附件图纸等,如果需要附件,请联系上传者。文件的所有权益归上传用户所有。
  • 3. 本站RAR压缩包中若带图纸,网页内容里面会有图纸预览,若没有图纸预览就没有图纸。
  • 4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
  • 5. 人人文库网仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对用户上传分享的文档内容本身不做任何修改或编辑,并不能对任何下载内容负责。
  • 6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
  • 7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。

评论

0/150

提交评论