GPU Accelerated NIDS Search

114 Pages·2012·1.98 MB·English

GPU Accelerated NIDS Search
Kristian Nordhaug
Master’sThesis
MasterofScienceinInformationSecurity
30ECTS
DepartmentofComputerScienceandMediaTechnology
GjøvikUniversityCollege,2012
Avdelingfor
informatikkogmedieteknikk
HøgskoleniGjøvik
Postboks191
2802Gjøvik
DepartmentofComputerScience
andMediaTechnology
GjøvikUniversityCollege
Box191
N-2802Gjøvik
Norway
GPU Accelerated NIDS Search
Kristian Nordhaug
2012/07/01

GPUAcceleratedNIDSSearch
Abstract
NetworkIntrusionDetectionSystem(NIDS)analyzesnetworktrafficformaliciousactivitiesand
report’sfindingsfromeventsthatintendtocompromisethesecurityofthecomputersandother
equipment.NIDSlooksintobothheadersandpayloadsofthenetworkpacketstoidentifypossible
intrusions.
NIDS models that only use Central Processing Units (CPU) such as the IDS Snort, have in
thelastdecadestruggledwiththeCPUasthebottleneckofthesystem.Networktraffichasbeen
increasing more rapidly than the clock-speed of CPUs. The CPUs have gained more cores, but
lack implementation for utilizing multi-core CPUs and are unable to cope with the bandwidth
throughputwearestartingtoseeinhigh-technetworkinfrastructurethattheyaresettoprotect.
ThemassiveflowsofdatapacketsoverloadtheNIDSandleadtopacketlosswhichmakesthem
pass by unchecked for malware and intrusion attempts, increasing the false-negative rate. The
main cause of this is the network packet inspection module in the detection engine of the NIDS.
The detection engine consists of numerous functions and ultimately contains an algorithm for
stringsearching.ThisthesiswillfocusonacceleratingtheNIDSbyparallelizingthisalgorithm.
In the recent years modern GPUs have evolved from being a tool that only displays high-
end graphics for games, to be used for general-purpose scientific and engineering computing
across a range of platforms [35]. GPU computing is the short term used when ordering the
GPU to take over and accelerate the computationally-intensive calculations normally done by
the CPU, and instead let the CPU take care of the more sequential parts of the application.
Theythenworktogethersolvingtasksinaheterogeneousco-processingcomputingmodel.Using
Graphics Processing Units (GPU) for general-purpose scientific and engineering computing has
grown exponentially the last few years. This has happened mostly from the work Nvidia has
put into their CUDA platform and programming model. Some of the most common areas for
useofGPUisfluiddynamics,seismicprocessing,moleculardynamics,computationalchemistry,
finance and supercomputing. Programs need to be specifically designed to run optimized on a
GPU,andspecialprogrammingAPIshavebeendesignedexplicitlyforGPUcomputing.Themost
well known ones are CUDA and OpenCL. In the recent year’s modern GPUs have evolved from
beingthetoolthatdisplayshigh-endgraphicsforgames,tobethetoolusedingeneral-purpose
scientificandengineeringcomputingacrossarangeofplatforms.
ThegoalofthisprojectwastoharnessthepowerwithinGPUsanduseittoaccelerateNIDS
suchasSnort,byusingCUDAtechnology.SeveralpapershavebeenpublishedonthetopicofGPU
acceleration,howeveronlyahandfulofthemtargetedNIDSwithvaryingresults.Webelievethis
canbeimproveddramaticallybyfurtherresearchinhowdifferenthardwarecomponentsinteract
and how to exploit the components and their APIs in new ways for creating high-performance
algorithmsolutions.
WepresentourimplementationsofknownstringsearchalgorithmsprogrammedinC++and
CUDA,withanalysisofthesealgorithmsandconcludewithcontributionsfromourexperiments
iii
GPUAcceleratedNIDSSearch
andtheoreticalanalysis.
iv
GPUAcceleratedNIDSSearch
Sammendrag
NIDS analyserer nettverkstrafikk for ondsinnede aktiviteter og rapporterer funn fra hendelser
som har til hensikt å kompromittere sikkerheten til datamaskiner og annet utstyr. En NIDS ser
innbådeheaderogpayloadavnettverkspakkerogidentifiserermuligeinntrengereisystemer.
NIDS modeller som kun benytter hovedprosessoren (CPU) som produktet Snort, har i det
siste tiåret kjempet med CPU som flaskehalsen i systemet. Nettverks trafikken har økt raskere
ennklokke-hastighetentilCPU.SelvomCPUharfåttflerekjerner,manglerdetimplementering
for å utnytte multi-core prosessorer i NIDS De klarer ikke lenger å takle mengden av trafikk
gjennomstrømming vi ser i high-tech nettverksinfrastruktur der de er satt for å beskytte. De
massive strømmene av datapakker overbelaster NIDS, som gjør at de krysser forbi uten å bli
sjekketformalwareoginnbruddsforsøk.Denviktigsteårsakentildetteermodulenforinspeksjon
avnettverkpakkerideteksjonmotorenpåNIDS.Deteksjonsmotorenbeståravmangefunksjoner
og inneholder en algoritme for streng søk. Denne oppgaven vil fokusere på å aksellerere NIDS
vedåparalleliseredennealgoritmen.
GPU databehandling er slang uttrykket for å bruke GPU til å overta og aksellerere intensive
beregninger, normalt gjort av CPU. CPU vil istedet få frihet til å ta seg av den mer sekvensielle
delen av søknaden. De arbeider deretter sammen for å løse oppgavene i en heterogen co-
prosessor databehandlings modell. Bruken av Graphical Processing Units (GPU) for generell
vitenskapeligogtekniskdatabehandlingharvoksteksponentieltdesisteårene.Detteharskjedd
hovedsakeligpågrunnavarbeidetNvidiaharlagtinnisinCUDAplattformogprogrammerings
modell. Noen av de vanligste områdene for bruk av GPU er veskedynamikk, seismisk prosesser-
ing,molekylærdynamikk,beregningsorientertkjemi,økonomiogsupercomputing.Programmer
måværespesieltdesignetforåkjøreoptimalisertpåenGPU,ogspesielleprogrammeringsAPIer
har blitt designet eksplisitt for GPU databehandling. De mest kjente er CUDA og OpenCL. I de
siste årene har moderne GPUer utviklet seg fra å være verktøyet som viser high-end grafikk for
spill, til å være et verktøy som brukes i generell vitenskapelig og teknisk databehandling på en
rekkeplattformer.
MåletmeddetteprosjekteteråutnyttekrafteniGPUogbrukedentilåakselerereNIDSsom
Snort,vedhjelpavCUDA-teknologi.FlereartiklererpublisertomtemaetGPU-akselerasjon,men
bare en håndfull målrettet mot NIDS, med varierende resultater. Vi tror dette kan forbedres
dramatisk ved videre forskning på hvordan ulike maskinvarekomponenter samhandler, og
hvordan man best utnytter komponentene og deres APIer på nye måter for å skape nye høyder
forytelseialgoritmiskeløsninger.
Vi presenterer våre implementasjoner av kjente streng søk algoritmer, programmert i C++
og CUDA, samt analyse av disse algoritmene og konluderer med bidrag fra våre eksperimenter
ogteroretiskeanalyse.
v

GPUAcceleratedNIDSSearch
Contents
Abstract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii
Sammendrag . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v
Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . vii
ListofFigures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix
ListofTables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xi
Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii
1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1 ProblemStatement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.3 ChoiceofMethods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.4 Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
2 StateoftheArt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.1 Relatedwork . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
2.1.1 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2 TechnicalBackground . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2.1 GraphicalProcessingUnits. . . . . . . . . . . . . . . . . . . . . . . . . . . 7
2.2.2 CUDA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.2.3 NIDS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.2.4 Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
3 Implementations&Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.1 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.2 Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.3 LabEnvironment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
3.4 Experiment#1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.4.1 Execution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
3.4.2 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
3.5 Experiment#2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.5.1 Knuth-Morris-Pratt(KMP) . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
3.5.2 Aho-Corasick(AC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
4 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
4.1 ResearchQuestions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
4.1.1 TowhatextentcanNIDSperformancebeincreasedbyusingGPU? . . . . 51
4.1.2 WhatpartsoftheNIDScanbeoptimized? . . . . . . . . . . . . . . . . . . 52
4.1.3 Which program specific factors give the increase, or decrease in perfor-
mance? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
4.2 SummaryofContributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
vii
GPUAcceleratedNIDSSearch
4.3 FutureResearch. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
A Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
A.1 Experiment#1:NaïveStringSearch . . . . . . . . . . . . . . . . . . . . . . . . . . 61
A.1.1 NaïveSearchEngine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
A.1.2 NaïveSearchKernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
A.1.3 NaïveSearchCPUImplementation . . . . . . . . . . . . . . . . . . . . . . 66
A.2 Experiment#2:Knuth-Morris-Phatt(KMP) . . . . . . . . . . . . . . . . . . . . . 68
A.2.1 KMPEngine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
A.2.2 KMPPreprocessing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
A.2.3 KMPKernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
A.3 Experiment#2:Aho-Corasick(AC) . . . . . . . . . . . . . . . . . . . . . . . . . . 75
A.3.1 Aho-CorasickEngine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
A.3.2 Aho-CorasickKernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
A.3.3 Aho-CorasickTreeStructure . . . . . . . . . . . . . . . . . . . . . . . . . . 80
A.3.4 Aho-CorasickCPUImplementation . . . . . . . . . . . . . . . . . . . . . . 85
A.4 Experiment-CommonFunctions . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
A.4.1 DictionaryStructure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
A.4.2 OutputHandler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
A.4.3 PacketHandler . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94
A.4.4 Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
viii