Abstract
While IoT is becoming widespread, cyber security of its devices is still a limiting factor where recent attacks (e.g., the Mirai bot-net) underline the need for countermeasures. One commonly-used security mechanism is a Network Intrusion Detection System (NIDS), but the processing need of NIDS has been a significant bottleneck for large dedicated machines, and a show-stopper for resource-constrained IoT devices. However, the topologies of IoT are evolving, adding intermediate nodes between the weak devices on the edges and the powerful cloud in the center. Also, the hardware of the devices is maturing, with new CPU instruction sets, caches as well as co-processors. As an example, modern single board computers, such as the Odroid XU4, come with integrated Graphics Processing Units (GPUs) that support general purpose computing. Even though using all available hardware efficiently is still an open issue, it has the promise to run NIDS more efficiently.
In this work we introduce CLort, an extension to the well-known NIDS Snort that (a) is designed for IoT devices (b) alleviates the burden of pattern matching for intrusion detection by offloading it to the GPU. We thoroughly explain how our design is used as part of the latest release of Snort and suggest various optimizations to enable processing on the GPU. We evaluate CLort in regards to throughput, packet drops in Snort, and power consumption using publicly available traffic traces. CLort achieves up to 52% faster processing throughput than its CPU counterpart. CLort can also analyze up to 12% more packets than its CPU counterpart when sniffing a network. Finally, the experimental evaluation shows that CLort consumes up to 32% less energy than the CPU counterpart, an important consideration for IoT devices.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Aho, A.V., Corasick, M.J.: Efficient string matching: an aid to bibliographic search. Commun. ACM 18(6), 333–340 (1975). https://doi.org/10.1145/360825.360855
Appneta: Sample captures. http://tcpreplay.appneta.com/wiki/captures.html/. Accessed 18 Sep 2018
Boyer, R.S., Moore, J.S.: A fast string searching algorithm. Commun. ACM 20(10), 762–772 (1977). https://doi.org/10.1145/359842.359859
Go, Y., Jamshed, M.A., Moon, Y., Hwang, C., Park, K.: Apunet: revitalizing GPU as packet processing accelerator. In: 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI 17), pp. 83–96. USENIX Association, Boston, MA (2017)
GPGPU: General-Purpose Computation on Graphics Hardware. http://gpgpu.org. Accessed 19 July 2018
Jacob, N., Brodley, C.: Offloading IDS computation to the GPU. In: 22nd Annual Computer Security Applications Conference (ACSAC 2006), pp. 371–380, December 2006. https://doi.org/10.1109/ACSAC.2006.35
Jamshed, M.A., et al.: Kargus: a highly-scalable software-based intrusion detection system. In: Proceedings of the 2012 ACM Conference on Computer and Communications Security, CCS 2012, pp. 317–328. ACM, New York (2012). https://doi.org/10.1145/2382196.2382232
Khronos group: OpenCL Overview. https://www.khronos.org/opencl/. Accessed 19 July 2018
Lin, C.H., Liu, C.H., Chien, L.S., Chang, S.C.: Accelerating pattern matching using a novel parallel algorithm on GPUs. IEEE Trans. Comput. 62(10), 1906–1916 (2013). https://doi.org/10.1109/TC.2012.254
NVIDIA: About CUDA. https://developer.nvidia.com/about-cuda. Accessed 19 July 2018
ODROID-XU3: ODROID-XU3. http://www.hardkernel.com/main/products/prdt_info.php?g_code=g140448267127. Accessed 08 June 2018
ODROID-XU4: ODROID-XU4 User Manual. https://magazine.odroid.com/wp-content/uploads/odroid-xu4-user-manual.pdf. Accessed 28 Mar 2018
Papadogiannaki, E., Koromilas, L., Vasiliadis, G., Ioannidis, S.: Efficient software packet processing on heterogeneous and asymmetric hardware architectures. IEEE/ACM Trans. Netw. 25(3), 1593–1606 (2017). https://doi.org/10.1109/TNET.2016.2642338
Sforzin, A., Mármol, F.G., Conti, M., Bohli, J.: RPiDS: raspberry Pi IDS - a fruitful intrusion detection system for IoT. In: 2016 International IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Congress (UIC/ATC/ScalCom/CBDCom/IoP/SmartWorld), Toulouse, France, 18–21 July 2016, pp. 440–448 (2016). https://doi.org/10.1109/UIC-ATC-ScalCom-CBDCom-IoP-SmartWorld.2016.0080
Shiravi, A., Shiravi, H., Tavallaee, M., Ghorbani, A.A.: Intrusion detection evaluation dataset (ISCXIDS2012), http://www.unb.ca/cic/datasets/ids.html. Accessed 08 May 2018
Shiravi, A., Shiravi, H., Tavallaee, M., Ghorbani, A.A.: Toward developing a systematic approach to generate benchmark datasets for intrusion detection. Comput. Secur. 31(3), 357–374 (2012). https://doi.org/10.1016/j.cose.2011.12.012
Tabrizi, F.M., Pattabiraman, K.: Flexible intrusion detection systems for memory-constrained embedded systems. In: 2015 11th European Dependable Computing Conference (EDCC), pp. 1–12. IEEE, September 2015. https://doi.org/10.1109/EDCC.2015.17
Vasiliadis, G., Antonatos, S., Polychronakis, M., Markatos, E.P., Ioannidis, S.: Gnort: high performance network intrusion detection using graphics processors. In: Lippmann, R., Kirda, E., Trachtenberg, A. (eds.) RAID 2008. LNCS, vol. 5230, pp. 116–134. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-87403-4_7
Vasiliadis, G., Polychronakis, M., Ioannidis, S.: Midea: a multi-parallel intrusion detection architecture. In: Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS 2011. ACM, New York (2011)
Xie, H., Xiang, Y., Chen, C.: Parallel Design and Performance Optimization based on OpenCL Snort. In: Proceedings of the 2017 2nd Joint International Information Technology, Mechanical and Electronic Engineering Conference, JIMEC (2017)
Acknowledgements
The research leading to these results has been partially supported by the Swedish Civil Contingencies Agency (MSB) through the project “RICS” and by the European Community Horizon 2020 Framework Programme through the UNITED-GRID project under grant agreement 773717. We also thank Simon Kindström for his help with the energy measurements.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this paper
Cite this paper
Stylianopoulos, C., Johansson, L., Olsson, O., Almgren, M. (2018). CLort: High Throughput and Low Energy Network Intrusion Detection on IoT Devices with Embedded GPUs. In: Gruschka, N. (eds) Secure IT Systems. NordSec 2018. Lecture Notes in Computer Science(), vol 11252. Springer, Cham. https://doi.org/10.1007/978-3-030-03638-6_12
Download citation
DOI: https://doi.org/10.1007/978-3-030-03638-6_12
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-03637-9
Online ISBN: 978-3-030-03638-6
eBook Packages: Computer ScienceComputer Science (R0)