A Survey of parallel intrusion detection on graphical processors
---
paper_title: Offloading IDS Computation to the GPU

paper_content:

Signature-matching Intrusion Detection Systems can experience significant decreases in performance when the load on the IDS-host increases. We propose a solution that off-loads some of the computation performed by the IDS to the Graphics Processing Unit (GPU). Modern GPUs are programmable, stream-processors capable of high-performance computing that in recent years have been used in non-graphical computing tasks. The major operation in a signature-matching IDS is matching values seen operation to known black-listed values, as such, our solution implements the string-matching on the GPU. The results show that as the CPU load on the IDS host system increases, PixelSnort?s performance is significantly more robust and is able to outperform conventional Snort by up to 40%.
---
paper_title: Offloading IDS Computation to the GPU

paper_content:

Signature-matching Intrusion Detection Systems can experience significant decreases in performance when the load on the IDS-host increases. We propose a solution that off-loads some of the computation performed by the IDS to the Graphics Processing Unit (GPU). Modern GPUs are programmable, stream-processors capable of high-performance computing that in recent years have been used in non-graphical computing tasks. The major operation in a signature-matching IDS is matching values seen operation to known black-listed values, as such, our solution implements the string-matching on the GPU. The results show that as the CPU load on the IDS host system increases, PixelSnort?s performance is significantly more robust and is able to outperform conventional Snort by up to 40%.
---
paper_title: Offloading IDS Computation to the GPU

paper_content:

Signature-matching Intrusion Detection Systems can experience significant decreases in performance when the load on the IDS-host increases. We propose a solution that off-loads some of the computation performed by the IDS to the Graphics Processing Unit (GPU). Modern GPUs are programmable, stream-processors capable of high-performance computing that in recent years have been used in non-graphical computing tasks. The major operation in a signature-matching IDS is matching values seen operation to known black-listed values, as such, our solution implements the string-matching on the GPU. The results show that as the CPU load on the IDS host system increases, PixelSnort?s performance is significantly more robust and is able to outperform conventional Snort by up to 40%.
---
paper_title: A framework for network traffic analysis using GPUs

paper_content:

During the last years the computer networks have become an important part of our society. ::: Networks have kept growing in size and complexity, making more complex its management ::: and traffic monitoring and analysis processes, due to the huge amount of data and calculations ::: involved. ::: In the last decade, several researchers found effective to use graphics processing units (GPUs) ::: rather than a traditional processors (CPU) to boost the execution of some algorithms not related ::: to graphics (GPGPU). In 2006 the GPU chip manufacturer NVIDIA launched CUDA, a ::: library that allows software developers to use their GPUs to perform general purpose algorithm ::: calculations, using the C programming language. ::: This thesis presents a framework which tries to simplify the task of programming network traffic ::: analysis with CUDA to software developers. The objectives of the framework have been abstracting ::: the task of obtaining network packets, simplify the task of creating network analysis ::: programs using CUDA and offering an easy way to reuse the analysis code. Several network ::: traffic analysis have also been developed.
---
paper_title: Parallelizing a network intrusion detection system using a GPU.

paper_content:

P ARRELLELIZING A NETWORK INTRUSION DETECTION SYSTEM USINGAGPU Anju Panicker Madhusoodhanan Sathik April II, 2012 As network speeds continue to increase and attacks get increasingly more complicated, there is need to improved detection algorithms and improved performance of Network Intrusion Detection Systems (NIDS). Recently, several attempts have been made to use the underutilized parallel processing capabilities of GPUs, to offload the costly NIDS pattern matching algorithms. This thesis presents an interface for NIDS Snort that allows porting of the pattern-matching algorithm to run on a GPU. The analysis show that this system can achieve up to four times speedup over the existing Snort implementation and that GPUs can be effectively utilized to perform intensive computational processes like pattern matching.
---
paper_title: A framework for network traffic analysis using GPUs

paper_content:

During the last years the computer networks have become an important part of our society. ::: Networks have kept growing in size and complexity, making more complex its management ::: and traffic monitoring and analysis processes, due to the huge amount of data and calculations ::: involved. ::: In the last decade, several researchers found effective to use graphics processing units (GPUs) ::: rather than a traditional processors (CPU) to boost the execution of some algorithms not related ::: to graphics (GPGPU). In 2006 the GPU chip manufacturer NVIDIA launched CUDA, a ::: library that allows software developers to use their GPUs to perform general purpose algorithm ::: calculations, using the C programming language. ::: This thesis presents a framework which tries to simplify the task of programming network traffic ::: analysis with CUDA to software developers. The objectives of the framework have been abstracting ::: the task of obtaining network packets, simplify the task of creating network analysis ::: programs using CUDA and offering an easy way to reuse the analysis code. Several network ::: traffic analysis have also been developed.
---
paper_title: Accelerating the local outlier factor algorithm on a GPU for intrusion detection systems

paper_content:

The Local Outlier Factor (LOF) is a very powerful anomaly detection method available in machine learning and classification. The algorithm defines the notion of local outlier in which the degree to which an object is outlying is dependent on the density of its local neighborhood, and each object can be assigned an LOF which represents the likelihood of that object being an outlier. Although this concept of a local outlier is a useful one, the computation of LOF values for every data object requires a large number of k-nearest neighbor queries -- this overhead can limit the use of LOF due to the computational overhead involved. Due to the growing popularity of Graphics Processing Units (GPU) in general-purpose computing domains, and equipped with a high-level programming language designed specifically for general-purpose applications (e.g., CUDA), we look to apply this parallel computing approach to accelerate LOF. In this paper we explore how to utilize a CUDA-based GPU implementation of the k-nearest neighbor algorithm to accelerate LOF classification. We achieve more than a 100X speedup over a multi-threaded dual-core CPU implementation. We also consider the impact of input data set size, the neighborhood size (i.e., the value of k) and the feature space dimension, and report on their impact on execution time.
---
paper_title: A GPU-Based Multiple-Pattern Matching Algorithm for Network Intrusion Detection Systems

paper_content:

By the development of network applications, network security issues are getting more and more important. This paper proposes a multiple-pattern matching algorithm for the network intrusion detection systems based on the GPU (Graphics Processing Units). The highly parallelism of the GPU computation power is used to inspect the packet content in parallel. The performance of the proposed approach is analyzed through evaluations such as using various texture formats and different implementations. Experimental results indicate that the performance of the proposed approach is twice of that of the modified Wu-Manber algorithm used in Snort. The proposed approach makes a commodity and cheap GPU card as a high performance pattern matching co-processor.
---
paper_title: Efficient Packet Pattern Matching for Gigabit Network Intrusion Detection Using GPUs

paper_content:

With the rapid development of network hardware technologies and network bandwidth, the high link speeds and huge amount of threats poses challenges to network intrusion detection systems, which must handle the higher network traffic and perform more complicated packet processing. In general, pattern matching is a highly computationally intensive process part of network intrusion detection systems. In this paper, we present an efficient GPU-based pattern matching algorithm by leveraging the computational power of GPUs to accelerate the pattern matching operations to increase the over-all processing throughput. From the experiment results, the proposed algorithm achieved a maximum traffic processing throughput of 2.4 Gbit/s. The results demonstrate that GPUs can be used effectively to speed up intrusion detection systems.
---
paper_title: Efficient string matching: an aid to bibliographic search

paper_content:

This paper describes a simple, efficient algorithm to locate all occurrences of any of a finite number of keywords in a string of text. The algorithm consists of constructing a finite state pattern matching machine from the keywords and then using the pattern matching machine to process the text string in a single pass. Construction of the pattern matching machine takes time proportional to the sum of the lengths of the keywords. The number of state transitions made by the pattern matching machine in processing the text string is independent of the number of keywords. The algorithm has been used to improve the speed of a library bibliographic search program by a factor of 5 to 10.
---
paper_title: Offloading IDS Computation to the GPU

paper_content:

Signature-matching Intrusion Detection Systems can experience significant decreases in performance when the load on the IDS-host increases. We propose a solution that off-loads some of the computation performed by the IDS to the Graphics Processing Unit (GPU). Modern GPUs are programmable, stream-processors capable of high-performance computing that in recent years have been used in non-graphical computing tasks. The major operation in a signature-matching IDS is matching values seen operation to known black-listed values, as such, our solution implements the string-matching on the GPU. The results show that as the CPU load on the IDS host system increases, PixelSnort?s performance is significantly more robust and is able to outperform conventional Snort by up to 40%.
---
paper_title: Gnort : High Performance Network Intrusion Detection Using Graphics Processors

paper_content:

The constant increase in link speeds and number of threats poses challenges to network intrusion detection systems (NIDS), which must cope with higher traffic throughput and perform even more complex per-packet processing. In this paper, we present an intrusion detection system based on the Snort open-source NIDS that exploits the underutilized computational power of modern graphics cards to offload the costly pattern matching operations from the CPU, and thus increase the overall processing throughput. Our prototype system, called Gnort, achieved a maximum traffic processing throughput of 2.3 Gbit/s using synthetic network traces, while when monitoring real traffic using a commodity Ethernet interface, it outperformed unmodified Snort by a factor of two. The results suggest that modern graphics cards can be used effectively to speed up intrusion detection systems, as well as other systems that involve pattern matching operations.
---
paper_title: A distributed network intrusion detection system architecture based on computer stations using GPGPU

paper_content:

This article deals with the proposal of distributed parallel network system architecture for intrusion detection. The aim is to design model of architecture that will be used for searching, detecting and analyzing intrusions. This proposal of detection system in network will use enormous performance of the GPGPU high-parallel data computing technology which can substitute the most complicated part of the intrusion detection process in NIDS. The model is highly scalable and allows the usage of several most recent trends in the IDS field with GPGPU support. Due to the fast attacks reaction system analyzes all the data in different formats in whole set of attacks and system alerts.
---

Title: A Survey of Parallel Intrusion Detection on Graphical Processors

Section 1: Introduction
Description 1: This section introduces the importance of intrusion detection systems (IDS) in an organization's security infrastructure, highlighting the increasing vulnerability to cyber threats and how IDS serves as a critical layer of defense.

Section 2: Background of IDS
Description 2: This section provides a fundamental understanding of IDS, discussing the approaches of anomaly detection and misuse detection, different steps involved in the process, and various types of IDS such as host-based and network-based systems.

Section 3: Detection Techniques
Description 3: This section elaborates on the different techniques used for intrusion detection, including anomaly detection and misuse detection, along with details on various methods like statistical analysis, neural networks, data mining, and genetic algorithms.

Section 4: IDS Performance Issues
Description 4: This section discusses the performance challenges IDS faces, particularly focusing on CPU-bound and I/O-bound limitations, and other factors that affect the efficiency of IDS, such as encryption and new sophisticated attacks.

Section 5: CPU-Bound Limitations
Description 5: This section delves deeper into the CPU-bound limitations in IDS, discussing the impact of system load, string-matching operations, and approaches to improve the runtime of packet comparisons.

Section 6: I/O-Bound Limitations
Description 6: This section focuses on the I/O-bound limitations in IDS, analyzing the bottleneck caused by packet reading operations and other constraints that hinder IDS performance.

Section 7: Advantages of Parallel Computing Implementation on GPU
Description 7: This section highlights the benefits of using GPU for parallel computing in IDS, detailing improved performance, better memory bandwidth, high scalability, and cost-effectiveness.

Section 8: Related Parallel Computing Implementations
Description 8: This section reviews various implementations and parallelization methods for intrusion detection using GPUs, examining several algorithms and techniques that enhance IDS performance.

Section 9: Intrusion Detection Tools Using GPU
Description 9: This section introduces specific tools and systems that utilize GPU for intrusion detection, describing their functionalities and effectiveness.

Section 10: Snort
Description 10: This section provides an overview of Snort, an open-source IDS solution using GPU technologies, discussing its components, architecture, and advantages.

Section 11: Pixel-snort
Description 11: This section discusses Pixel-Snort, an extension of Snort, focusing on offloading packet processing tasks to GPU to enhance performance.

Section 12: Gnort
Description 12: This section details Gnort, an IDS tool that leverages GPGPU technologies for improved packet processing and comparison performance.

Section 13: Suricata
Description 13: This section introduces Suricata, an advanced IDS project that supports GPU and multithreading for efficient load distribution and high performance.

Section 14: Conclusion
Description 14: This section concludes the survey by summarizing the advancements in GPGPU technologies for IDS, discussing current prototypes, and emphasizing the potential for future developments in parallel computing for intrusion detection.