Creating a collaborative architecture in snorts to high speed networks
Afshin Rezakhani Roozbahani, Leila Rikhtechi · 2010
As networks become faster, there is a need for intrusion detection systems that can gather all traffic in a network. We propose a collaborative architecture for snorts to improve the power of snorts in high speed networks. We utilize a preprocessor system in entrance of network and place snorts in hosts. We place a knowledgebase in preprocessor to send traffic property to specific snort. The first advantage of this approach is its ability to work in high speed networks, and the second advantage of this approach is its ability to detect identical attacks quickly without any computing. We also consider several scenarios and show that the overhead traffic of our approach in network is decreased and balanced gradually.