An efficient hash-based load balancing scheme to support parallel NIDS

Abstract

Today, as the scale of network grows up, a standalone NIDS with only one intrusion detection node is not enough to inspect all traffic. One of the most widely considered solutions to address this problem is to configure parallel NIDS in which multiple intrusion detection nodes work together. A load balancing mechanism enables this configuration by distributing traffic load to several nodes. In the frequently changing environment of today's network, it is an important issue for load balancing mechanism to distributing traffic equally to each node. Meanwhile, several studies have been made on the load balancing scheme, but they do not satisfy the requirements of load balancing for parallel NIDS. Thus we proposed HLPN (Hash-based Load balancing scheme suitable for Parallel NIDS) which satisfies these requirements. As a result of the performance evaluation, HLPN represented 58% better performance in terms of the fairness of the traffic distribution than static hash-based scheme, and gave almost equal, or rather better, performance to that of DHFV. © 2011 Springer-Verlag.