DC: Small: Scaling the Performance of Network Security Applications Using Massively Parallel Processing Array (MPPA) Architectures

以非常高的网络线路速率（现在为10 Gbps，不久将扩展到40到100 Gbps）执行网络安全应用程序（如恶意软件检测、基于规则的网络入侵检测和隐蔽通道检测）对于保护企业网络至关重要。 在这个研究项目中，我们正在研究MPPA（大规模并行处理阵列）架构的适用性，以扩展数据包处理和分析任务，以满足下一代高速网络提出的安全挑战。在我们的初步工作的基础上，我们正在研究并行实现的算法，需要在许多不同的网络安全应用程序。这些包括1）用于流量分类的K-means聚类算法，2）用于异常检测的熵计算算法，3）用于基于规则的网络入侵检测的模式匹配，以及4）加密和解密加速引擎。我们正在研究这些算法可以并行化的MPPA架构与大量的处理器有限的内存和如何利用可编程处理器互连优化算法的并行实现。 我们正在寻求一种实验方法，通过建立一个测试平台系统，以支持基于网络流量和跟踪驱动的分析。 通过我们的研究，我们希望量化MPPA架构的能力，以扩展数据密集型计算越来越高的线速率。并行算法和网络安全应用程序的实现将提供给其他研究人员。预计参与该项目的研究生和本科生将获得计算机网络安全，信号处理和并行处理交叉领域的培训。

Performing network security applications such as malware detection, rule-based network intrusion detection, and covert channel detection at very high network line rates (10 Gbps now and soon scaling up to 40 to 100 Gbps) is critical to safeguarding enterprise networks. In this research project, we are investigating the applicability of MPPA (Massively Parallel Processing Array) architectures to scale packet processing and analysis tasks to meet the security challenges presented by next generation high-speed networks. Building upon our preliminary work, we are investigating parallel implementations of algorithms that are required in many different network security applications. These include 1) the K-means clustering algorithm used in traffic classification, 2) the entropy computation algorithm used in anomaly detection, 3) pattern matching used in rule-based network intrusion detection, and 4) encryption and decryption acceleration engines. We are investigate how these algorithms can be parallelized in a MPPA architecture with a large number of processors with limited memory and how the programmable processor interconnect can be leveraged to optimize the parallel implementation of algorithms. We are pursuing an experimental approach by building a testbed system to support both network traffic based and trace driven analyses. Through our research we expect to quantify the ability of MPPA architectures to scale data intensive computations for higher and higher line rates. The parallel algorithms and the implementation of the network security applications will be made available to other researchers. It is expected that graduate and undergraduate students involved in this project will obtain training in areas intersecting computer networks security, signal processing, and parallel processing.