TC: Small: A High-Performance Abstract Machine for Network Intrusion Detection

网络入侵检测系统(NID)需要在一组难以同时充分解决的挑战之间取得平衡：网络通信的复杂性；需要极其高效地运行以获得线速性能；以及安全地处理不可信的输入。我们的项目旨在在有效应对这些挑战和提供描述安全策略所需的高级抽象之间建立一座高效且安全的桥梁。注意到网络入侵检测系统的实现在很大程度上共享了功能，我们在NIDS处理中引入了一个新的中间层，由两个主要部分组成：第一个是专门为网络入侵检测领域量身定做的抽象机模型，它直接支持指令集中该领域的常见抽象和习惯用法；第二个是编译策略，将为抽象机编写的程序转换为针对给定目标平台的高度优化的本地可执行代码，性能与手动编写的C代码相当。作为一个更广泛的目标，我们的承诺为安全社区提供了一种新的体系结构，该体系结构促进了网络流量分析通常需要的构建块的开发和重复使用。虽然我们的工作重点是抽象机器环境本身的设计和实现，但我们设想通过在我们开发的平台上构建分析功能，使社区能够充分释放其潜力。

Network intrusion detection systems (NIDS) need to balance between a set of challenges difficult to simultaneously address to their full extent: the complexity of network communication; the need to operate extremely efficiently to achieve line-rate performance; and dealing securely with untrusted input. Our project aims to build an efficient and secure bridge between dealing effectively with these challenges, and offering the high-level abstractions required for describing a security policy. Observing that NIDS implementations share a large degree of functionality, we introduce a new middle-layer into NIDS processing, consisting of two main pieces: first, an abstract machine model that is specifically tailored to the network intrusion detection domain and directly supports the field's common abstractions and idioms in its instruction set; and second, a compilation strategy for turning programs written for the abstract machine into highly optimized, natively executable code for a given target platform, with performance comparable to manually written C code. As a broader goal, our undertaking provides the security community with a novel architecture that facilitates development and reuse of building blocks commonly required for network traffic analysis. While the focus of our effort is the design and implementation of the abstract machine environment itself, we envision enabling the community to unleash its full potential by building analysis functionality on top of the platform we develop.