네트워크 프로세서 기반 고성능 네트워크 침입 탐지 엔진에 관한 연구 = An Implementation of Network Intrusion Detection Engines on Network Processors

국문 초록 (Abstract)

초고속 인터넷 망이 빠른 속도로 구축이 되고, 네트워크에 대한 해커나 침입자들의 수가 급증함에 따라, 실시간 고속 패킷 처리가 가능한 네트워크 침입 탐지 시스템이 요구되고 있다. 본 논문에서는 일반적으로 소프트웨어 방식으로 구현된 침입 탐지 시스템을 고속의 패킷 처리에 뛰어난 성능을 가지고 있는 네트워크 프로세서를 이용하여 재설계 및 구현하였다. 제한된 자원과 기능을 가지는 다중 처리 프로세서(Multi-processing Processor)로 구성된 네트워크 프로세서에서 고성능 침입 탐지 시스템을 실현하기 위하여, 최적화된 자료구조와 알고리즘을 설계하였다. 그리고 더욱 효율적으로 침입 탐지 엔진을 스케줄링(scheduling)하기 위한 침입 탐지 엔진 할당 기법을 제안하였으며, 구현과 성능 분석을 통하여 제안된 기법의 적절성을 검증하였다.

다국어 초록 (Multilingual Abstract)

Recently with the explosive growth of Internet applications, the attacks of hackers on network are increasing rapidly and becoming more seriously. Thus information security is emerging as a critical factor in designing a network system and much attention is paid to Network Intrusion Detection System (NIDS), which detects hackers’ attacks on network and handles them properly. However, the performance of current intrusion detection system cannot catch the increasing rate of the Internet speed because most of the NIDSs are implemented by software. In this paper, we propose a new high performance network intrusion using Network Processor. To achieve fast packet processing and dynamic adaptation of intrusion patterns that are continuously added, a new high performance network intrusion detection system using Intel’s network processor, IXP1200, is proposed. Unlike traditional intrusion detection engines, which have been implemented by either software or hardware so far, we design an optimized architecture and algorithms, exploiting the features of network processor. In addition, for more efficient detection engine scheduling, we proposed task allocation methods on multi-processing processors. Through implementation and performance evaluation, we show the proprieties of the proposed approach.

목차 (Table of Contents)

• 요약
• Abstract
• 1. 서론
• 2. 관련연구
• 3. 네트워크 프로세서 기반 네트워크 침입 탐지 시스템
• 4. 고속 네트워크 침입 탐지 엔진
• 5. 침입 탐지 엔진 할당 기법
• 6. 성능 평가
• 7. 결론 및 향후 계획
• 참고문헌
• 저자소개

참고문헌 (Reference)

1 "snort source, version 1.8.6" 2002.

2 "Towards a taxonomy of intrusion detection system" 31 (31): 805-822, 1990.

3 "Teja Technologies"

4 "Snort 홈페이지"

5 "PyaloadPlus Routing Switch Processor" 2002.

6 "Packet Excalibur, version 1.0" 2002.

7 "Optimization and benchmark of cryptographic algorithms on network processors" 24 : 55-69, 2004.

8 "Network Processors for Access Network(NP4AN) Trends and Challenges" 2004

9 "Network Processors Applied to IPv4/IPv6 Transition" 17 : 2003.

10 "Network Processor based High-speed Network Intrusion Detection System" 973-982, 2004

11 "Network Processing Forum homepage"

12 "Network Intrusion Detection" 8 (8): 26-41, 1994.

13 "NP-Complete Fore agere System PayloadPlus Family of Network Processor" 2002.

14 "Korea Information Security Agency"

15 "Introduction to TCP/IP Offload Engine" 2002

16 "Intel corporation homepage"

17 "Intel Network Processors product information."

18 "Increasing Performance in High Speed NIDS" 2002.

19 "Implementation of 10Gigabit Packet Switching Using IXP Network Processors" 1 : 532-535, 2003

20 "IBM homepage"

21 "High-Performance Implementation for Graph-Based Packet Classification Algorithm on Network Processor" 2 : 1268-1272, 2004

22 "Fast Regular Expression Matching using FPGAs" 2001.

23 "ENP-2506 Hardware Reference" 2002.

24 "DARPA Intrusion Detection Evaluation"

25 "COAST(Computer Operations, Audit, and Security Technology)"

26 "C-port Documentation" 2002.

27 "An Efficient Packet Classification Algorithm for Network Processors" 3 : 1596-1600, 2003

28 "An Active Traffic Splitter Architecture for Intrusion Detection" 238-241, 2003.10

29 "A Fast String Searching Algorithm" 20 (20): 761-772, 1977.