Signature-based Network Intrusion Detection Systems (NIDS) is state-of-the-art for precise attack detection. Using multiple instances of NIDS in parallel is considered the most promising solution for improving its processing speed in the scale of high speed network. This can be realized by (1) distributing the network traffic between multiple NIDS to reduce the network load per system or (2) distributing the signatures (rules) between multliple NIDS to reduce the work load per packet. In this paper, we study distribution strategies targeting application and transport layer for both traffic and rule distribution approaches. In addition, we investigate the importance of considering the processing speed optimization in the rule development phase. Our experiments show that in general traffic distribution performs slightly better in terms of packet drop and alert detection compared to rule distribution. The Transport layer distribution strategy shows traffic distribution parallelization detecting 1.6% more alerts and dropping 6% less packets. We also show that optimizing the rules sets further improves the processing speed significantly.

Signature-based Network Intrusion Detection Systems (NIDS) have become state-of-the-art in modern network security solutions. However, most systems are not designed for modern high-speed network links. In the field of network monitoring, an alternative solution has become the choice for such high-speed networks. Flow-monitoring, typically based on the Internet Protocol Flow Information Export (IPFIX) standard, now goes well beyond collecting statistical information about network connections. Current solutions are even able to include selected parts of the payload in these Flows to be used in conjunction with NIDS. Recently, we extended this concept to application layer HTTP Flows. We now present our improved version of the IPFIX-based Signature-based Intrusion Detection System (FIXIDS).Fixidsmakes use of HTTP intrusion detection signatures from the popular Snort system and applies them to incoming IPFIX-conforming HTTP Flows. Our evaluation shows thatFixidscan deal with four times higher network data rates without drops compared to Snort, while maintaining the same event detection rate. Furthermore, a substantial part of the data traffic can be outsourced toFixidsso that Snort can be relieved of a significant portion of rules and traffic. This increases both the detection rate and the data rate the overall security appliance can handle.

Signature-based Network Intrusion Detection Systems (NIDS) are the state-of-the-art when it comes to precise attack detection and intrusion prevention. However, they experience critical performance problems in modern high-speed networks. At the same time, flow-based network monitoring has been investigated for high data rates. In the last years, such flow-monitoring went beyond collecting statistical information about network connections and more recent techniques are able to include selected samples of the payload of these flows. Most recently, we extended this concept to HTTP flows. We now go one step further and combine IPFIX-based flow monitoring with NIDS. We developed IPFIX-based Signature-based Intrusion Detection System (FIXIDS), a system that exploits the recently introduced HTTP related flow Information Elements (IEs) to do signature-based flow intrusion detection in high-speed networks on commodity hardware. FIXIDS makes use of HTTP intrusion signatures from the widely used Snort NIDS and applies them to incoming IPFIX Flows. In the experimental evaluation, we are able to show a performance gain of a factor of three compared to Snort while maintaining the same detection ratio.

Signature-based Network Intrusion Detection Systems (NIDS) are an integral part of modern network security solutions. They help to detect and prevent network attacks and intrusions. However, they show critical performance problems in today's high speed networks. Filters have been proposed to reduce the amount of traffic to be analyzed by a NIDS, yet, such filters need to be very carefully designed in order not to miss relevant data. We address this problem by proposing a novel concept for filtering taking into account the pipelining architecture of modern web traffic. Our concept, which we named HTTP-based Payload Aggregation (HPA), is able to retain the first N bytes of the basic Protocol Data Unit (PDU) of an application layer protocol and discard the rest, arguing that the retained payload portion contains almost all relevant data for intrusion detection. We demonstrate the feasibility of our approach focusing on HTTP traffic as the most prominent protocol in many Internet applications. The idea is, thus, to capture the first N bytes of every pipelined session and forward this data to a NIDS. In our evaluation, we show that for the used traces we still detect more than 97% of the events with only 2.5% of the network traffic to be analyzed. We achieve an increase in packet throughput of up to 44 in our experiments.

Network monitoring is the basis to analyze communications for preventing network attacks and misuse. Common practice for today's high throughput networks are flow-based network monitoring techniques like IPFIX. However, these solutions do not support the observation of HTTP/1.1 request/response dialogs. At the same time, we observe an increasing trend to use HTTP pipelining in the Internet as well as the use of HTTP as a generic transport protocol. IPFIX-based network monitoring and attack detection is no longer able to identify misbehavior in the complex and often interlaced HTTP dialogs. This work presents a new monitoring concept, which is able to aggregate HTTP/1.1 dialog information into bidirectional IPFIX flows. It is thereby laying the foundation for network security tools like IDS to process the resulting flows faster and more efficiently. The evaluation shows that the implemented parsing mechanism can even deal with complex HTTP traffic and clearly outperforms existing solutions.