a taxonomy of parallel techniques for intrusion detection
Intrusion detection systems (IDS) have become a key component in ensuring the safety of systems and networks. These systems enforce a security policy by inspecting arriving packets for known signatures (patterns). This process actually involves several tasks that collectively incur a significant delay. As network line speeds continue to increase, it is crucial that efficient scalable approaches, such as parallelization, are developed for IDS. In this paper we develop a framework which may be used to classify various approaches to parallelizing intrusion detection systems. Parallelization of IDS can occur at three general levels: node (entire system), component (specific task), and sub-component (function within a specific task). We categorize existing and proposed parallel solutions using our framework, discuss the advantages and disadvantages of each, and provide empirical evaluation of one form of parallelism. Additionally, we introduce the notion of functional parallelism for intrusion detection.
intrusion detection systems (ids) security