MASCOTS 2003 An Active Traffic Splitter Architecture for Intrusion Detection Ioannis Charitakis Institute of Computer Science Foundation of Research And Technology Hellas, FORTH Joint work with: Evangelos Markatos, FORTH Kostas Anagnastakis, UPENN

MASCOTS 2003 Overview Introduction –Snort and Network Intrusion Detection Systems NIDS: highly intensive operation –Simple Splitter An Active Traffic Splitter –Light-weight functionality Early Filtering and Locality Buffers –Improves NIDS performance up to 19% –Summary and Future Work

MASCOTS 2003 Introduction Snort ( –Passive Network Monitoring – rules (grouped by application) –Highly Intensive Operation Current Snort Performance –One high end PC: Mbit/s –Multi gigabit links ? –Multiple Sensors

MASCOTS 2003 Simple Splitter High rate single link Lower rate multiple links SnortV2 SPLITTERSENSORS Find target Sensor

MASCOTS 2003 Motivation Use an Active Splitter Move simple IDS functionality from sensor to splitter –Use of Early Filtering (EF) Enhance performance of each sensor transparently. –No need to modify sensors –Use of Locality Buffering (LB)

MASCOTS 2003 Simple Splitter (repeated) High rate single link Lower rate multiple links SnortV2 SPLITTERSENSORS Find target Sensor

MASCOTS 2003 Active Splitter Architecture

MASCOTS 2003 Active Splitter Architecture SnortV2 ACTIVE SPLITTER SENSORS EF Reduce #pkts to process Find target Sensor LB: Traffic Shaping

MASCOTS 2003 Active Splitter Feature: EF Early Filtering –Discard packets before reaching any sensor –Fewer packets to process, Fewer interrupts Early Filtering Header-only rules 10% of all rules Small packets No payload Further processing No match

MASCOTS 2003 Active Splitter Feature: LB Locality Buffers –Group similar packets together –Enhance performance of cache memory SnortV2 webp2pftpwebp2p

MASCOTS 2003 ftp Active Splitter Feature: LB Locality Buffers –Group similar packets together –Enhance performance of cache memory SnortV2 webp2pwebp2p

MASCOTS 2003 LB: Implementation Locality Buffer 1 SnortV2 Locality Buffer 2 Locality Buffer N Hash on dst port

MASCOTS 2003 Rational Of Operation

MASCOTS 2003 Snort Operation 1.Packet classification Port Group 2.Multipattern search engine Eligible signatures 3.Packet header analysis Fully matched signatures 4.Alert, Log, Discard, …

MASCOTS 2003

Memory Organization Main memory –Slow –Large –Has everything Cache –Faster –Smaller –Has regularly accessed data (tries to…) Data and Instructions are fetched to cache before use

MASCOTS 2003 Memory Organization MAIN MEM I CACHE D CACHE CPU

MASCOTS 2003 Performance Measurements Simple Splitter versus : –Splitter/LB –Splitter/EF –Splitter/LB+EF Simulations –All measurements on same machine –Trace (NLANR) split and shaped to several files –Snort v2 build 20 Measured processing time (user + system time)

MASCOTS 2003 PM: Per number of Sensors

MASCOTS 2003 PM: Per number of LBs

MASCOTS 2003 PM: Per LB Size

MASCOTS 2003 PM: Burst size

MASCOTS 2003 Early Filtering Performance Number of packets with no content –40% with no payload Reduction in system time –16.8% (10.1  8.7sec) Reduction in user time –6.6% (45.67  42.66sec) Combined reduction –8%

MASCOTS 2003 LB + EF Performance 4 Sensors 16 LBs 256 KB / LB Aggregate User Time –19.8% (47.27  37.88sec) Slowest Sensor –14.4% (12.38  10.93sec)

MASCOTS 2003 Summary and Future Work Active Splitter –Early Filtering –Locality Buffers Enhances performance Transparently –No need to change Sensors –Simulations are promising Future Work –Implementation