Upload
others
View
2
Download
0
Embed Size (px)
Citation preview
A GRAPHICS PROCESSING UNIT BASED NETWORK INTRUSION
DETECTION SYSTEM WITH BLOOM FILTER PATTERN MATCHING
ALGORITHM
ONG WEN JIAN
A project report submitted in partial fulfilment of the
requirements for the award of the degree of
Master of Engineering (Electrical – Computer and Microelectronic System)
Faculty of Electrical Engineering
Universiti Teknologi Malaysia
JANUARY 2015
iii
Dedicated, in thankful appreciation for the support, encouragement and
understandings to my beloved parents, brother and sister.
iv
ACKNOWLEDGEMENT
During the preparation of this thesis, I met with many people, researchers and
academicians who had provided me with lots of advice and guidance. In particular, I
would like to express my deepest appreciation to my main thesis supervisor and co-
supervisor, Dr. Usman Ullah Sheikh and Associate Professor Dr. Muhammad Nadzir
Marsono for their continuous support, guidance, critics and motivations throughout
the entire project. I truly appreciate all the support, guidance and critics provided as
this helped me to become a better researcher in the field of Electrical and Electronics
Engineering field. Also, I would like to thank to the members of the examination
committee, mainly Associate Professor Muhammad Mun’im Ahmad Zabidi and Dr.
Zaid Omar.
I would like to express my gratitude to all my family members who have
been supporting and motivating me throughout my academic years. This academic
year was not easy to complete especially to handle both work and academic
workload at the same time. Hence, I am grateful to all my family members who
support me all the way.
My sincere appreciation also to all my colleagues and friends mainly Chin
Teck Loong, Kelvin Quek Wei Luo, Ee Poey Guan and Dr. Khairulmizam Samsudin
who have provided me the advantageous suggestions, cooperation and technical
support. Unfortunately, it is not possible to list all of them in this limited space.
However, their assistance is highly appreciated.
v
ABSTRACT
Network Intrusion Detection System (NIDS) is a network security system
designed and built to detect malicious packets by monitoring the incoming and
outgoing network packets. The computer network speed has now reached Gigabit per
second (Gbps) due to rapid development of network hardware technologies. This
project proposes a Graphics Processing Unit (GPU) based NIDS with Bloom Filter
pattern matching algorithm. Bloom Filter is a set of data structures to determine if a
given piece of data belongs to a set and it is widely used for the pattern matching
applications. The system developed is able to support network packets with TCP,
UDP and ICMP protocols. The developed system is simulated with Snort NIDS
ruleset version 2.9. Experimental results indicate that the throughput achieved is 3.6
Gbps with a false positive probability of 3.04 x 10-8
.
vi
ABSTRAK
Sistem Pengesan Pencerobohan Rangkaian (NIDS) adalah satu sistem
keselamatan yang direkabentuk and dibina untuk mengesan paket rangkaian yang
berbahaya dengan memantau paket rangkaian keluar dan masuk yang mencurigakan.
Perkembangan pesat teknologi perkakasan rangkaian telah membantu meningkatkan
kelajuan rangkaian komputer yang kini telah mencapai Gigabit sesaat (Gbps). Projek
ini mencadangkan satu Sistem Pengesan Pencerobohan Rangkaian dengan
algorithma pengesan corak penapisan Bloom dengan menggunakan Kad
Pemprosesan Grafik (GPU). Pengesan corak Penapisan Bloom adalah satu set
struktur data yang dibina untuk menentukan sama ada data yang diberikan adalah
data yang terkandung dalam set tersebut atau sebaliknya. Sistem yang dibangunkan
dalam projek ini mampu menerima paket rangkaian berdasarkan protokol TCP, UDP
dan ICMP. Satu simulasi ke atas sistem yang dibangunkan dalam projek ini
dijalankan dengan menggunakan peraturan Snort versi 2.9. Keputusan eksperimen
menunjukan bahawa masa pemprosesan yang dicapai adalah 3.6 Gbps dengan
kebarangkalian positif palsu 3.04 x 10-8
.
vii
TABLE OF CONTENTS
CHAPTER TITLE PAGE
DECLARATION ii
DEDICATION iii
ACKNOWLEDGEMENT iv
ABSTRACT v
ABSTRAK vi
TABLE OF CONTENTS vii
LIST OF TABLES xi
LIST OF FIGURES xii
LIST OF ABBREVIATIONS xiv
LIST OF APPENDICES xvi
1 INTRODUCTION 1
1.1 Introduction 1
1.2 Problem Statement And Motivation 2
1.3 Aim and Objectives 3
1.4 Project Scope 3
1.5 Thesis Organization 4
viii
2 LITERATURE REVIEW 5
2.1 Intrusion Detection Systems 5
2.1.1 Types of Intrusion Detection Systems 6
2.1.2 General Architecture of Intrusion Detection
System
7
2.2 Snort: An Open Source Network Intrusion
Detection System
11
2.3 Graphics Processing Unit 11
2.3.1 NVIDIA GPU Architecture 14
2.3.2 GPGPU: General Purpose Computing on
Graphic Processing Unit
15
2.4 CUDA Architecture and Programming Model for
GPGPU
16
2.4.1 CUDA Memory Layout 16
2.4.2 CUDA Data Management Model 18
2.4.3 Sample CUDA Code 19
2.5 Bloom Filter Pattern Matching Algorithm 22
2.5.1 Hash Functions 23
2.6 Related Works 24
3 METHODOLOGY 28
3.1 Introduction 28
3.2 Design and Development Process 30
3.3 Software and Hardware Requirements 31
3.3.1 CUDA Software Development Toolkit
version 5.5
32
3.3.2 Microsoft Visual Studio 2008 32
3.3.3 WinPcap version 4.1.3 and Developer
Pack version 4.1.2
32
3.3.4 Nemesis 1.4.1 32
3.4 Proposed Framework Design Architecture 33
3.5 Algorithm and Data Structure Design for
ix
Detection Engine with Bloom Filter Pattern
Matching Algorithm
35
3.6 System Functionality and Performance
Evaluation Methodologies
41
4 RESULTS AND DISCUSSIONS 43
4.1 Introduction 43
4.2 Bloom Filter pattern matching algorithm design 43
4.2.1 Arash Partow Hash Function 44
4.2.2 Performance evaluation of the Bloom
Filter pattern matching algorithm design
45
4.3 Network Packet Capture Module Design 47
4.4 System Performance Evaluation 49
4.5 Comparison with the previous work 53
5 CONCLUSION 54
5.1 Conclusions 54
5.2 Future Work 55
REFERENCES 56
Appendices A - B 59
x
LIST OF TABLES
TABLE NO. TITLE PAGE
3.1 Class members for CBloom_Parameters 38
3.2 Class functions for CBloom_Parameters 38
3.3 Class members for CBloom_Filter 39
3.4 Class functions for CBloom_Filter 39
3.5 Performance Metrics Summary for Inrusion Detection
System (IDS) evaluation
43
4.1 CPU hardware specification 46
4.2 GPU hardware specification 46
4.3 Packet Loss Rate comparison between GPU and CPU
as pattern matching engine for NIDS
50
4.4 Signature List Insertion Time 51
4.5 Average pattern matching query time per signature 52
4.6 Performance Metrics of the NIDS with Bloom Filter
(m=65536 and k=8) with Arash Partow (AP) Hash
Function
53
4.7 Comparison with previous works 55
xi
LIST OF FIGURES
FIGURE NO. TITLE PAGE
2.1 Computer Network Security System with Firewall
and NIDS
8
2.2 Basic architecture of IDS 9
2.3 Flow Chart of Data Collection Module 10
2.4 Flow Chart of Detection Module 11
2.5 GPU hardware graphics pipeline 13
2.6 Comparison of Floating Points Operations per second
between the (a) CPU and (b) GPU
14
2.7 High level overview of internal architecture
difference between the (a) CPU and (b) GPU
14
2.8 Block diagram of Nvidia GeForce GT 640M LE 15
2.9 Block diagram of ALU on NVIDIA SMX 16
2.10 Block diagram of CUDA memory layout 18
2.11 (a) Ideal and (b) non-ideal hash functions mapping
set U to set V
26
2.12 A Counting Bloom Filter with 4-bit up/down
counters
28
3.1 Flow chart of the entire project 31
3.2 Design and Development Process Framework 32
3.3 Block diagram of proposed framework architecture 35
3.4 Design of GPU based Detection Engine for Bloom
Filter Pattern Matching Algorithm
37
3.5 Design of parallel Bloom Filter with GPU 41
xii
4.1 Performance Comparison between the CPU and GPU
in pattern matching with Bloom Filter algorithm (m =
65536 and k = 8)
48
4.2 False Positive Probability for Bloom Filter
(m=65536, k=8) with Arash Partow (AP) Hash
Function
48
4.3 Snapshot of network packet send and receive
between the virtual Operating System and the host
PC
49
4.4 Packet Loss Rate comparison between GPU and CPU
as pattern matching engine for Network Intrusion
Detection System
50
4.5 Signature List Insertion Time 52
4.6 Average Pattern Matching Query Time 53
4.7 System Accuracy comparison between GPU and
CPU as a pattern matching engine
54
xiii
LIST OF ABBREVIATIONS
AGP - Accelerated Graphics Port
ALU - Arithmetic Logic Unit
AP - Arash Partow
API - Application Programming Interface
ASIC - Application Specific Integration Circuit
CUDA - Compute Unified Device Architecture
CPU - Central Processing Unit
FLOPS - Floating Point Operations Per Second
FN - False Negative
FP - False Positive
FPGA - Field Programmable Gate Array
GHz - Gigahertz
GPU - Graphics Processing Unit
GPGPU - General Purpose Computation on Graphics Processing
Units
HIDS - Host Intrusion Detection System
ICMP - Internet Control Message Protocol
IDE - Integrated Development Environment
IDS - Intrusion Detection System
IP - Internet Protocol
IPv4 - Internet Protocol version 4
IPv6 - Internet Protocol version 6
LFSR - Linear Feedback Shift Register
MHz - Megahertz
xiv
NIC - Network Interface Card
NIDS - Network Intrusion Detection System
OS - Operating System
PC - Personal Computer
PCI-e - Peripheral Component Interconnect Express
RAM - Random Access Memory
SDK - Software Development Kit
SDLC - Software Development Life Cycle
SIMD - Single Instruction Multiple Data
SIMT - Single Instruction Multiple Thread
SMX - Streaming Multiprocessor
SP - Streaming Processor
TCP - Transmission Control Protocol
TN - True Negative
TP - True Positive
UDP - User Datagram Protocol
VPU - Video Processing Unit
1
CHAPTER 1
INTRODUCTION
1.1 Introduction
Internet is a world-wide computer network, which is a network that
interconnects millions of computing devices around the world. Each device in a
computer network is assigned to one Internet Protocol (IP) address to enable the
sending and receiving of information within the Internet.
Network Intrusion Detection System (NIDS) is one of the network security
systems built to detect malicious packets by monitoring the incoming and outgoing
network packets [1]. The computer network speed has now reach Gigabit per second
(Gb/s) due to rapid development of network hardware technologies. This poses a
huge amount of challenge to NIDS, which must be able to handle the higher network
traffic and also must be able to perform complicated packet processing.
In this project, the purpose is to design and develop a signature based
Network Intrusion Detection System with the Graphics Processor Unit (GPU). The
GPU is chosen over other computer hardware such as Field Programmable Gate
Array (FPGA), Network Processor and General Purpose Processor (CPU) for the
implementation of NIDS due to high computation power, parallel processing
capabilities and has a lower design cost [1]. The increased programmability of the
GPU also is more flexible than FPGAs with the introduction of General Purpose
Computation on Graphics Processing Units (GPGPU).
Bloom filter pattern matching algorithm is chosen to implement this signature
based NIDS with GPU. The GPU hardware chosen in this project is GeForce GT
2
640M LE manufactured by NVIDIA Corporation. The system will be designed and
developed using Compute Unified Device Architecture (CUDA) Software
Development Kit (SDK) released by NVIDIA Corporation. The functionality and the
performance of the system will be evaluated in terms of packet processing
throughput and false positive rates.
1.2 Problem Statement and Motivation
Network speed and bandwidth have increased dramatically over the past few
years, thanks to the rapid development of the computer network hardware
technologies [1]. The future of network security devices must be able to responsed
fast at wire speed.
The computing industry has been concentrating on parallel computing in the
past few years. NVIDIA Corporation introduced a parallel programming framework
known as Compute Unified Device Architecture (CUDA) for its GPU in the year
2006 [2] and this overcame the limitation of the traditional Central Processing Unit
(CPU) in parallel computing. A GPU offers high performance throughput with little
overhead between the threads. Data parallelism in an application can be achieved
through parallel computing and this provides an opportunity for data processing to be
completed in less time and also increase the computational power.
In addition to that, the design cost on the GPU is lower compared to FPGA
and ASIC such as Network Processors as it is available in almost every computer
nowadays. It is also reported that the computational speed of the GPU is faster if
compared to FPGA and ASIC due to rapid development of the multi-core hardware
design [1].
This project is motivated by the need to increase the speed, performance and
the efficiency of the pattern matching algorithm used in NIDS to detect an attack. It
is reported that in a typical NIDS system, the pattern matching detection engine to
detect an attack alone occupies about 75% of the CPU processing time [1]. This
shows that pattern matching is a computational intensive process and this will affect
3
the overall performance of the system and there is a need to improve overall system
performance. Bloom Filter pattern matching algorithm is chosen as the main
algorithm for NIDS threat detection engine design. There is also design challenges in
converting the conventional serial Bloom Filter processing in a serial method to a
parallel processing method with GPU.
1.3 Aim and Objectives
The aim of this project is to design and develop a NIDS based on Bloom filter
algorithm with NVIDIA based GPU. The objectives are:
a) To achieve a high performance GPU based NIDS
b) To achieve a novel parallel implementation of Bloom Filter algorithm for
NIDS based on GPU
c) To evaluate the functionality and performance of the system in terms of
packet processing time and false positive rates
1.4 Project Scope
The scope of this project is to design and develop a GPU based NIDS with
NVIDIA GeForce GT 640M LE by using CUDA SDK.
IPv4 TCP, UDP and ICMP protocol sample network packets with some
random attack signature will be then generated on the local host with Nemesis
version 1.4.1 software to evaluate the functionality and the performance of the build
model. The attack signature database to detect an attack will be based on Snort rules
set version 2.9 and above.
The functionality and the performance of the build model will be evaluated
based on the packet processing throughput time and also the false positive rates.
4
1.5 Thesis Organization
This thesis is organized as follows. Chapter 2 contains the Literature Review
of the project and the basic concept required in understanding this project. This
includes the overview of the Intrusion Detection System, overview of Snort – an
open source Network Intrusion Detection System, overview of Graphics Processing
Unit and also an overview of Bloom Filter. The work related to GPU based pattern
matching algorithm and Bloom Filter based pattern matching algorithm for NIDS are
also discussed in this chapter.
Chapter 3 defines the Methodology of this project and the steps on how the
proposed signature based NIDS with GPU was designed and developed. This chapter
also discusses about the software and hardware requirements for this project and the
methodologies on how the overall developed system’s functionality and the
performance will be evaluated.
Chapter 4 presents the Results and Discussion. This chapter presents the
performance evaluation results of the complete system. This chapter also presents the
comparison of this work with the previous work.
Chapter 5 presents the conclusion chapter and this chapter discussed on the
overall results of the implementation, problem faced and suggestions for future work.
56
REFERENCES
1. Che-Lun Hung, Hsiao-his Wang, Chin-Yuan Chang and Chun-Yuan Lin,
Efficient Packet Pattern Matching for Gigabit Network Intrusion Detection
using GPUs: IEEE 14th International Conference on High Performance
Computing and Communications. 25-27 June, 2012. Liverpool: IEEE 2012.
1612-1617.
2. Alexander Gee. Research into GPU accelerated pattern matching for
applications in computer security. University of Canterbury, Christchurch;
2009
3. Ambarish Jadhav, Avinash Jadhav, Pradeep Jadhav and Prakash Kulkarni,
A Novel Approach for the Design of Network Intrusion Detection System
(NIDS): International Conference on Sensor Network Security Technology
and Privacy Communication System. 18-19 May, 2013. Nangang: IEEE
2013. 22-27.
4. Charles P. Pfleeger, Security in Computing, Upper Saddle River: Prentice
Hall.
5. Marc Su˜n´e Clos. A framework for network traffic analysis using GPUs.
Master’s Thesis. Universitat Politecnica de Catalunya; 2010.
6. Martin Schutte. Design and Implementation of an IPv6 plugin for Snort
Intrusion Detection Systems. Diploma’s Thesis. Potsdam University; 2011.
7. G. Gu, P. Fogla, D. Dagon, W. Lee and B. S. koric.Measuring Intrusion
Detection Capability: An Informatic-Theoretic Approach: ACM Symposium
on Information, Computer and Communications Security. 21-24 March,
2006. Taipei
8. V. Jyothsna, V. V. Rama Prasad and K. Munivara Prasad. A Review of
Anomaly Based Intrusion Detection Systems. International Journal of
Computer Applications (0975 – 8887),2011. vol. 28. no. 7, pp. 26-35.
9. Nen-Fu Huang, Hsien-Wei Hung, Sheng-Hung Lai, Yen-Ming Chu and
Wen-Yen Tsai, A GPU-based Multiple-pattern Matching Algorithm for
Network Intrusion Detection Systems: 22nd International Conference on
Advanced Information Networking and Applications. 25-28 March, 2008.
Okinawa:IEEE 2008, 62-67.
57
10. Shu-qiang Huang, Huan-ming Zhang and Guo-xiang Yao. Research of
NIDS in IPv6 Based on Protocol Analysis and Pattern Matching : 2nd
International Workshop on Knowledge Discovery and Data Mining. 23-25
January,2009 Moscow: IEEE 2009, 542-545.
11. "The libpcap project," SourceForge, 28 May 2013. [Online]. Available:
http://sourceforge.net/projects/libpcap/. [Accessed 16 September 2013].
12. "WinPCap," [Online]. Available: http://www.winpcap.org/. [Accessed 16
September 2013].
13. "Snort," [Online]. Available: http://www.snort.org/. [Accessed 16
September 2013].
14. K. Salah and A. Kahtani. Improving Snort performance under Linux: IET
Communications.2009 vol. 3, no. 12, pp. 1883-1895.
15. E.I.Verburg. GPU based Rendering to a Multiview Display. Department of
Mathematics and Computer Science, Eindhoven; 2006
16. Wen Jian Ong, Khairulmizam Samsudin, Abdul Rahman Ramli and Wan
Azizun Wan Adnan, Modeling Graphic Subsystem for M5 Simulator: IEEE
Conference on Open Systems. 25-28 September, 2011. Langkawi. IEEE
2011. 294-299
17. W. Dally and J. Nickolls. The GPU Computing Era: IEEE Micro.2010 vol.
30, no. 2, pp. 56-69
18. Nigel Jacob amd Carla Brodley, Offloading IDS Computation to the GPU:
22nd Annual Computer Security Applications Conference. December, 2006
Miami Beach.IEEE 2006. 371-380.
19. Y. Liu and E. Wu, Emerging Technology about GPGPU: IEEE Asia Pacific
Conference, 30 November – 3 December, 2008. Macao. IEEE 2008. 618-
622.
20. NVIDIA Corporation (2013). CUDA C Programming Guide. California:
NVIDIA Corporation.
21. NVIDIA Corporation (2012). White Paper- NVIDIA GeForce GTX 680.
Santa Clara: NVIDIA Corporation.
22. Jared Harwayne-Gidansky, Deian Stefan and Ishaan Dalal, FPGA based
SoC for Real-Time Network Intrusion Detection using Counting Bloom
Filters: IEEE Southeastcon, 5-8 March, 2009.Atlanta. IEEE 2009. 452-458.
58
23. Tabataba F.S and Hashemi M.R, Improving False Positive in Bloom Filter:
19th Iranian Conference on Electrical Engineering (ICEE), 17-19 May,
2011. Tehran. IEEE 2011.1-5.
24. P. Mahdinia, M. Berenjkoob and H. Vatankhah, Attack Signature Matching
using Graphics Processors in High Performance Intrusion Detection
Systems: 21st Iranian Conference on Electrical Engineering (ICEE), 14-16
May, 2013. Mashhad. IEEE 2013.1-7.
25. B. Soewito, E. Flanigan and J. Pangrazio. Modified Data Structure of Aho-
Corasick. Southern Illinois University , Carbondale; 2006
26. Ong Wen Jian. Modeling Graphic Subsystem For M5 Simulator. Bachelor’s
Thesis. Universiti Putra Malaysia, Selangor;2011
27. Ong Wen Mei, Baskaran V. M, Poh Kit Chong, Ettikan K.K and Keh Kok
Yong, A parallel Bloom Filter String Searching Algorithm on many-core
processor: IEEE Conference on Open Systems , 2-4 December, 2013.
Kuching. IEEE 2013.1-6.
28. Parvathaneni. Tejaswini, K.V.S Mounika and A.Rama Krishna, IPV6 and
Deep Packet Inspection: International Journal of Innovative Technology
and Exploring Engineering, 2012, vol. 1, no. 6, pp. 62-65.