Security of today's networks heavily rely on network intrusion detection systems (NIDSs). The ability to promptly update the supported rule sets and detect new emerging attacks makes field-programmable gate arrays (FPGAs) a very appealing technology. An important issue is how to scale FPGA-based NIDS implementations to ever faster network links. Whereas a trivial approach is to balance traffic over multiple, but functionally equivalent, hardware blocks, each implementing the whole rule set (several thousands rules), the obvious cons is the linear increase in the resource occupation. In this work, we promote a different, traffic-aware, modular approach in the design of FPGA-based NIDS. Instead of purely splitting traffic across equivalent modules, we classify and group homogeneous traffic, and dispatch it to differently capable hardware blocks, each supporting a (smaller) rule set tailored to the specific traffic category. We implement and validate our approach using the rule set of the well-known Snort NIDS, and we experimentally investigate the emerging trade-offs and advantages, showing resource savings up to 80 percent based on real-world traffic statistics gathered from an operator's backbone.

A Network Intrusion Detection System (NIDS) inspects the traffic flowing in a network to detect malicious content such as spam, viruses, and so on. Hardware based solutions appear necessary to face the performance requirements emerging when the goal is to deploy such systems in high speed network scenarios. However, the appropriate choice of the hardware platform is believed to be subject to at least two requirements, usually considered independent each other: i) it needs to be reprogrammable, in order to update the intrusion detection rules each time a new threat arises, and ii) it must be capable of containing the typically very large set of rules of existing NIDSs. The goal of this paper is to show that reprogrammability can be further exploited to reduce the resource requirements for the chosen platform. Specifically, we propose an FPGA-based solution that classifies and dispatches traffic to elastic buffers, connecting one buffer at a time to a dynamically reconfigurable rule matching core. This core supports only the appropriate subset of detection rules. A worst-case analysis shows that the saving in hardware resources is achieved with a relatively small buffer space, currently available in cheap, low end, FPGA boards, with no impairment on the resulting throughput.

We present an efficient network measurement primitive that measures the rate of variations, or unique values for a given characteristic of a traffic flow. The primitive is widely applicable to a variety of data reduction and pre-analysis tasks at the measurement interface, and we show it to be particularly useful for building data-reducing preanalysis stages for scan detection within a multistage network analysis architecture. The presented approach is based upon data structures derived from Bloom filters, and as such yields high performance with probabilistic accuracy and controllable worst-case time and memory complexity. This predictability makes it suitable for hardware implementation in dedicated network measurement devices. One key innovation of the present work is that it is self-tuning, adapting to the characteristics of the measured traffic.

Abstract The 3GPP architecture includes the Multimedia Broadcast Multicast Service (MBMS) to provide efficient broadcast and multicast services. In the 3GPP long‐term evolution, the evolved MBMS (e‐MBMS) architecture is currently being standardized. Unlike MBMS, the new e‐MBMS architecture explicitly raises, as additional security requirement, the protection of the IP multicast user plane. Currently proposed e‐MBMS security architectures “limit” themselves to suggest the deployment of Group Security Associations (GSA). In this paper, we start by discussing that, on one side, GSA might not be a sufficiently secure solution in the long run, and on the other side GSA integration within the e‐MBMS architecture might not be as straightforward as it might appear. The point made in this paper is that there are sound alternatives to GSA if the goal is to deploy a short‐term solution with basically no impact on the current e‐MBMS architecture. In particular, we propose to adopt a Secure Multicast Overlay (SMO) approach. To prove the straightforward implementation of SMO we describe how a proof‐of‐concept test‐bed over public domain linux routers. Moreover, a functional comparison between GSA and SMO leads us to the following conclusions: (i) not only SMO provides the same level of security of GSA, but also it achieves a reduced risk of denial of service attacks; (ii) SMO has significant advantages over GSA in terms of impact on the architecture and on device requirements; (iii) security association management and key management in GSA has a greater impact on the performance achievable than in the case of SMO. We believe that these advantages outweigh the performance penalties due to overlay networking overhead. Copyright © 2008 John Wiley & Sons, Ltd.