Concurrency issues in rule-based Network Intrusion Detection Systems

As the bandwidth of present networks gets larger than the past, the demand of Network Intrusion Detection Systems (NIDS) that function in real time becomes the major requirement for high-speed networks. If these systems are not fast enough to process all network traffic passing, some malicious security violations may take role using this drawback. In order to make that kind of applications schedulable, someconcurrency mechanism is introduced to the general flowchart of their algorithm. The principal aim is to fully utilize each resource of the platform and overlap the independent parts of the applications. In the sense of this context, a generic multithreaded infrastructure is designed and proposed. The concurrency metrics of the new system is analyzed and compared with the original ones. © 2008 Atilla Elçi