Design of Cloud-Based Parallel Exclusive Signature Matching Model in Intrusion Detection
Yuxin Meng, Wenjuan Li, Lam For Kwok · 2013
Signature-based intrusion detection systems have been widely deployed in current network environments to defend against various attacks, but the expensive process of signature matching is a major suffering problem for these detection systems. Thus, a high-performance signature matching scheme is of great importance for a signature-based IDS. In our previous work, we have developed an exclusive signature matching scheme that aims to identify a mismatch instead of locating an accurate match and achieved good results in the experiments. With the advent of Cloud Computing, IDS as a service (IDSaaS) has been proposed as an alternative by offloading the expensive operations such as the process of signature matching to the cloud. In this paper, we attempt to design a parallel model to conduct the exclusive signature matching in a cloud. In the evaluation, we implemented our model in a cloud environment and investigated its performance compared with Snort. The experimental results indicate that our proposed model can achieve promising performance in such a cloud environment.