Characterizing the Performance of Network Intrusion Detection Sensors
Characterizing the Performance of Network Intrusion Detection Sensors
复制标题
表征网络入侵检测传感器的性能
DOI：
--
复制
发表时间：
2003
期刊：
影响因子：
--
通讯作者：
C. Freeland
中科院分区：
文献类型：
--
作者：
Lambert Schaelicke;Thomas Slabach;Branden J. Moore;C. Freeland
网络入侵检测系统（NIDS）正在成为保护关键信息和基础架构的重要工具。 NID的质量通过检测到的真实攻击的百分比与虚假警报的数量相结合来描述。但是，即使是高质量的NIDS算法，如果其处理成本太高，则无效，因为数据包的丢失会增加未检测到攻击的可能性。这项研究测量并比较了许多不同系统上NIDS处理成本的两个主要组成部分，以查明性能瓶颈并确定操作系统和建筑差异的影响。结果表明，即使在中等速度网络上，许多系统也不足以作为NIDS平台。性能不仅取决于处理器性能，还取决于在很大程度上还取决于内存系统。处理器微体系结构朝深层管道的最新趋势对系统的功能有负面影响，而多处理器体系结构通常不会带来重大的性能改善。总体而言，这些结果为NIDS开发人员和采用者提供了有价值的指南，以选择合适的平台，并强调需要在开发和评估NIDS技术时考虑处理成本。
Network intrusion detection systems (NIDS) are becoming an important tool for protecting critical information and infrastructure. The quality of a NIDS is described by the percentage of true attacks detected combined with the number of false alerts. However, even a high-quality NIDS algorithm is not effective if its processing cost is too high, since the resulting loss of packets increases the probability that an attack is not detected. This study measures and compares two major components of the NIDS processing cost on a number of diverse systems to pinpoint performance bottlenecks and to determine the impact of operating system and architecture differences. Results show that even on moderate-speed networks, many systems are inadequate as NIDS platforms. Performance depends not only on the processor performance, but to a large extent also on the memory system. Recent trends in processor microarchitecture towards deep pipelines have a negative impact on the systems NIDS capabilities, and multiprocessor architectures usually do not lead to significant performance improvements. Overall, these results provide valuable guidelines for NIDS developers and adopters for choosing a suitable platform, and highlight the need to consider processing cost when developing and evaluating NIDS techniques.