Towards Software-Based Signature Detection for Intrusion Prevention on the Network Card
نویسندگان
چکیده
CardGuard is a signature detection system for intrusion detection and prevention that scans the entire payload of packets for suspicious patterns and is implemented in software on a network card equiped with an Intel IXP1200 network processor. One card can be used to protect either a single host, or a small group of machines connected to a switch. CardGuard is non-intrusive in the sense that no cycles of the host CPUs are used for intrusion detection and the system operates at Fast Ethernet link rate. TCP flows are first reconstructed before they are scanned with the Aho-Corasick algorithm.
منابع مشابه
تولید خودکار الگوهای نفوذ جدید با استفاده از طبقه‌بندهای تک کلاسی و روش‌های یادگیری استقرایی
In this paper, we propose an approach for automatic generation of novel intrusion signatures. This approach can be used in the signature-based Network Intrusion Detection Systems (NIDSs) and for the automation of the process of intrusion detection in these systems. In the proposed approach, first, by using several one-class classifiers, the profile of the normal network traffic is established. ...
متن کاملImprovement and parallelization of Snort network intrusion detection mechanism using graphics processing unit
Nowadays, Network Intrusion Detection Systems (NIDS) are widely used to provide full security on computer networks. IDS are categorized into two primary types, including signature-based systems and anomaly-based systems. The former is more commonly used than the latter due to its lower error rate. The core of a signature-based IDS is the pattern matching. This process is inherently a computatio...
متن کاملNetwork intrusion prevention on the network card
CardGuard is a signature detection system for intrusion prevention that scans the entire payload of packets for suspicious patterns and is implemented in software on a network card. The hardware that is used on the card consists of an Intel IXP and various memories. One card can be used to protect either a single host, or a small group of machines connected to a switch. CardGuard is non-intrusi...
متن کاملA Review of Intrusion Detection Defense Solutions Based on Software Defined Network
Most networks without fixed infrastructure are based on cloud computing face various challenges. In recent years, different methods have been used to distribute software defined network to address these challenges. This technology, while having many capabilities, faces some vulnerabilities in the face of some common threats and destructive factors such as distributed Denial of Service. A review...
متن کاملProspector : a protocol-specific detector of polymorphic buffer overflows
While future attacks are likely to be increasingly polymorphic, current intrusion detection methods tend to be either powerless in the face of attack mutation, or too inaccurate to be used as intrusion prevention filters. Our system, known as Prospector consists of three components. First, an emulatorbased honey-pot uses taint analysis to detect zeroday intrusion attempts with great accuracy. S...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 2005