SOSWS Host Shield: A sketchbased Service Oriented Shield against web application business layer IDS attacks Abstract   The Intrusion Detection Systems (IDS) is becoming important and pretty timespace consuming due to the rising level of explosive data flood. All through the past decades, there have been plenty of studies propose software mechanism to take advantage of the temporal locality in the IDS systems. Yet, it require substantial memory block to accumulate the redundancy table. As a result the performance as well as the memory consumption is still value pursuing. To tackle the above weak point, in this paper, we present SOS (Service Oriented Shield) Host Shield, which explore the guard for business layer against IDS Attack. The SOS Web Shield supports Host based HTTPS protection system. The SOS Host Shield includes 3 stages, one is Generalized Patchbased IDS Verifier, and next one is Service Oriented Hashbased support and finally SOS of IntruXML. The SOS Host Shield create virtualized prevent system for host based IDS. This improves the effectiveness of SOS Host shield by avoid the attack in HTTPs of malicious user at hosts. We developed a prototype of SOS Host shield and watchfully evaluate its efficiency using real attack data collected from a largescale web cluster.

Analysing performance issues of opensource intrusion detection systems in highspeed networks Abstract   Driven by the growing data transfer needs, industry and research institutions are deploying 100xc2xa0Gbs networks. As such highspeed networks become prevalent, these also introduce significant technical challenges. In particular, an Intrusion Detection System (IDS) cannot process network activities at such a high rate when monitoring large and diverse traffic volumes, thus resulting in packet drops. Unfortunately, the high packet drop rate has a significant impact on detection accuracy. In this work, we investigate two popular opensource IDSs: Snort and Suricata along with their comparative performance benchmarks to better understand drop rates and detection accuracy in 100xc2xa0Gbs networks. More specifically, we study vital factors (including system resource usage, packet processing speed, packet drop rate, and detection accuracy) that limit the applicability of IDSs to highspeed networks. Furthermore, we provide a comprehensive analysis to show the performance impact on IDSs by using different configurations, traffic volumes and different flows. Finally, we identify challenges of using opensource IDSs in highspeed networks and provide suggestions to help network administrators to address identified issues and give some recommendations for developing new IDSs that can be used for highspeed networks.