An active traffic splitter architecture for intrusion detection

摘要: Scaling network intrusion detection to high speeds can be achieved using multiple sensors operating in parallel coupled with a suitable load balancing traffic splitter. This paper examines splitter architecture that incorporates two methods for improving system performance: the first is use of early filtering where portion packets processed on instead sensors. The second locality buffering, reorders way improves memory access Our experiments suggest reduces number by 32%, giving 8% increase sensor performance, while buffers improve performance about 10%. Combined together, result an overall improvement 20% slowest improved 14%.