Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/18/2020
09:10 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Researchers Say They've Developed Fastest Open Source IDS/IPS

With a five-processor core, "Pigasus" delivers the same performance as a system with between 100 and 700 cores, according to a team from Carnegie Mellon University's CyLab.

Researchers at Carnegie Mellon University's CyLab security and privacy institute have devised what they say is the world's fastest open source intrusion detection and prevention system (IDS/IPS).

Presenting their work at the USENIX Symposium on Operating Systems Design and Implementation earlier this month, the researchers described their invention, named "Pigasus," as achieving speeds of 100 Gbps using a single five-processor core server and a field programmable gate array (FPGA). Typically that kind of performance would require between 100 and 700 processor cores and a whole rack of systems, the researchers said. According to the researchers, their approach uses 38 times less power than a CPU-only IDS/IPS.

Related Content:

7 Ways to Get the Most from Your IDS/IPS

The Changing Face of Threat Intelligence

New on The Edge: An Inside Look at an Account Takeover

FPGAs are integrated circuits that can be configured after manufacture to perform a variety of different processing tasks, which is unlike typical CPUs where the functions are already fully baked in. FPGAs are often used to boost a computing system's performance in a variety of ways, including by offloading certain tasks from the CPU and executing them separately. Big cloud vendors like Amazon Web Services and Microsoft use FPGAs to bolster storage and network performance, among other things, especially for demanding high-performance computing (HPC) applications.

The FPGA in CyLab's Pigasus system is programmed to detect network intrusions using algorithms that are much faster than those available with typical IDS/IPS, according to the researchers. The FPGA can inspect some 95% of data traffic on a network on its own for signs of malware and malicious activity, while the remaining 5% is handled by the server's five processor cores.

Justine Sherry, assistant professor at CMU's school of computer science, says the project is designed to demonstrate a more cost-effective approach to inspecting Internet traffic for malicious activity than current approaches. With Internet services continuously producing more data, organizations are under pressure to find new, cost-effective ways of monitoring the traffic.

"Today's line rates can be 100 Gbps or even higher," Sherry says. "Securing computer networks requires monitoring all of this traffic for malicious content."

Unfortunately, for most organizations, monitoring 100 Gbps or more is extremely expensive in terms of equipment and power, Sherry says. As a result, some organizations these days only "sample" traffic and send it through an IDS/IPS to keep a lid on costs.

"We show in our research paper that using Snort 3.0, a software IDS would require anywhere from 70 to 677 processor cores to keep up with 100 Gbps," she notes. "Our hope is that Pigasus can help bring the cost of detection down and make it feasible to do more comprehensive monitoring for these networks."  

For the moment, Pigasus remains a research project. CyLab researchers used network traces from real deployments to test the system. But it has not been put through a live operational network yet.

CyLab is working on pushing the project code to the open source community so others can use it for free. CMU is also collaborating with researchers at the University of Virginia and the University of Maryland on ways to improve the system. Others are taking Pigasus apart for other use cases, Sherry said, without elaborating.

"Commercialization remains an open question for our team to discuss in the future," she says.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
11/30/2020 | 3:35:58 PM
Re: Typo
Good catch on the typo, @fixitcamp. It has been corrected. Thank you.
fixitcamp
50%
50%
fixitcamp,
User Rank: Guru
11/18/2020 | 9:52:34 AM
Typo
FGPA should be FPGA
Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I can't find the back door.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21275
PUBLISHED: 2021-01-25
The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of Medi...
CVE-2021-21272
PUBLISHED: 2021-01-25
ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the ...
CVE-2021-23901
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...
CVE-2020-17532
PUBLISHED: 2021-01-25
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting