Increasing the Efficiency of IDS Systems by Hardware Implementation of Packet Capturing
Zeinab Latifi, Kamal Jamshidi, Ali Bohlooli · International Journal of Computer Network and Information Security · 2013
Capturing is the first step in intrusion detection system (IDS).Having wire speed, omitting the OS fro m capturing process and no need for making a copy of packets from the system's environ ment to the user's environment are some o f the system characteristics.If these requirements are not met, packet capture system is considered as the main bottleneck of IDS and the overall efficiency of this system will be influenced.Presence of all these three characteristics calls for utilizat ion of hardware methods.In this paper, by using of FPGA, a line sniffing and load balancing system are designed in order to be applied in IDS systems.The main contribution of our work is the feasibility of attaching labels to the beginning part of each packet, aiming at quick easy access of other IDS modules to information of each packet and also reducing workload of these modules.Packet classification in the proposed system can be configured to 2, 3, and 5 tuple, wh ich can also be applied in IDS detection module in addition to load balancing part of this system.Load balancing module uses Hash table and its Hash function has the least flows collisions.This system is imp lemented on a set of virtex 6 and 7 families and is ab le to capture packets 100% and perform the above mentioned processes by speed of 12 Gbit/s.