The NIDS Cluster: Scalable, Stateful Network Intrusion Detection on Commodity Hardware
In this work we present a NIDS cluster as a scalable solution for realizing high-performance, stateful network intrusion detection on commodity hardware. The design addresses three challenges: (i) distributing traffic evenly across an extensible set of analysis nodes in a fashion that minimizes the communication required for coordination, (ii) adapting the NIDS's operation to support coordinating its low-level analysis rather than just aggregating alerts; and (iii) validating that the cluster produces sound results. Prototypes of our NIDS cluster now operate at the Lawrence Berkeley National Laboratory and the University of California at Berkeley. In both environments the clusters greatly enhance the power of the network security monitoring.
- Research Organization:
- Lawrence Berkeley National Lab. (LBNL), Berkeley, CA (United States)
- Sponsoring Organization:
- Chemical Sciences Division
- DOE Contract Number:
- DE-AC02-05CH11231
- OSTI ID:
- 935341
- Report Number(s):
- LBNL-714E; TRN: US200815%%657
- Resource Relation:
- Conference: Recent Advances in Intrusion Detection 2007, Queensland, Australia, September, 2007
- Country of Publication:
- United States
- Language:
- English
Similar Records
Detecting and Blocking Network Attacks at Ultra High Speeds
Alerts Visualization and Clustering in Network-based Intrusion Detection