The NIDS Cluster: Scalable, Stateful Network Intrusion Detection on Commodity Hardware
In this work we present a NIDS cluster as a scalable solution for realizing high-performance, stateful network intrusion detection on commodity hardware. The design addresses three challenges: (i) distributing traffic evenly across an extensible set of analysis nodes in a fashion that minimizes the communication required for coordination, (ii) adapting the NIDS's operation to support coordinating its low-level analysis rather than just aggregating alerts; and (iii) validating that the cluster produces sound results. Prototypes of our NIDS cluster now operate at the Lawrence Berkeley National Laboratory and the University of California at Berkeley. In both environments the clusters greatly enhance the power of the network security monitoring.
- Research Organization:
- Ernest Orlando Lawrence Berkeley National Laboratory, Berkeley, CA (US)
- Sponsoring Organization:
- Chemical Sciences Division
- DOE Contract Number:
- AC02-05CH11231
- OSTI ID:
- 935341
- Report Number(s):
- LBNL-714E
- Country of Publication:
- United States
- Language:
- English
Similar Records
Alerts Visualization and Clustering in Network-based Intrusion Detection
Alerts Analysis and Visualization in Network-based Intrusion Detection Systems