Elephant: Network Intrusion Detection Systems that Don't Forget

摘要: Modern Network Intrusion Detection Systems (NIDSs) maintain state that helps them accurately detect attacks. Because most NIDSs are signature-based, it is critical to update their rule-sets frequently; unfortunately, doing so can result in downtime causes be lost, leading vulnerabilities of attack misclassification. In this paper, we show such do exist and provide a way avoid them. Using the open-source NIDS Snort, present Elephant, an approach implementation for updating provides cause Snort enter safe quiescent point, load new rules into memory, remove old from memory-all while preserving required make sure does not miss We critique performance evaluation our technique.