Implementation and performance evaluation of high-performance intrusion detection and response system

Abstract

Many Intrusion Detection Systems are developed till now to respond network attacks, which is increasing more and more in number and has polymorphic/metamorphic nature. Most of these systems, however, have problem to process traffic volume that is increasing continuously whereby systems are designed and developed only for real-time security analysis over Fast Ethernet network. Therefore it is necessary to research on security analysis mechanism which is capable to process high traffic volume over the high speed network such as Gigabit Ethernet network. This paper proposes Gigabit Intrusion Detection System to detect and respond attacks on the high speed network. It is possible through the pattern matching functions which is based on the packet header and data that is processed in the system kernel level and FPGA Logic. Our proposed Gigabit Intrusion Detection System has hardware architecture that can provide efficient way to detect and respond variant attack behaviors on high-speed and high volume large-scale network. © Springer-Verlag 2004.