方案实现(JSQ需要保证同一个流)

1、Para-Snort : A Multi-thread Snort on Multi-Core IA PlatformTsinghua UniversityPDCS 2021November 3, 2021Xinming Chen, Yiyao Wu, Lianghong Xu, Yibo Xue and Jun LiOutlineIntroduction of NIDS on IASome previous workStructure of our system, whats different? Detailed module designBreaking the bottlenecksP

2、ara-Snort PerformanceConclusions2NIDS on IA platformNIDS(Network Intrusion Detection System) looks into both header and payload of packets to identify intrusionWhy on IA platform?low priceeasily to developflexibility on structure and rulesetBut not so fast as ASICs or FPGA! 3The structure of NIDSSno

3、rt by Sourcefire Inc.The most popular open source NIDS on IA platformPreprocess and Detect cost most computation power 4Way to speed up?Multicore IA platformLeads the trends of higher processor computation powerNeed parallel structure of the software Rarely leveraged in existing NIDSTwo previous wor

4、k: Supra-linear and MultiSnort5Supra-linear Packet ProcessingIntel Co. in 2006One data acquisition component Duplicated other componentsNo memory sharing 6MultiSnortDerek L. Schuff, Purdue University.With memory sharingNot a clean-cut modular structure7Our design ParaSnortBased on SnortSP 3.0, a new

5、 different branchModular designMultifunction processing modulesMemory sharingOptimization on core algorithms Sufficient speedup8Detailed module designData Sourcedata acquisition and decoder Load Balancedispatches traffic and makes multi-staged processingProcessing Moduleeach is a single threadprepro

6、cessors and detection engineeasy to develop functions other than intrusion detection, such as antivirus or URL filtering Output moduleGenerate alert9Optimize Load BalancingSnortSP 3.0 provides IP hash algorithmNot so balance when there are few flowsThree improve methods: 5-tuple hashJoin the Shortes

7、t QueueModified-JSQReassign a flow when it has silenced for a long time10Optimize Multi-pattern MatchingSnortSP 3.0 provides AC algorithmAC works fast, and when there are few matches, the cache locality is high.But when there are many matches in the traffic, the cache locality turns bad.We introduce

8、d AC-WM to reduce the size of the state machines of compiled ruleset.While costs much less memory, AC-WM is a bit slower than AC for ordinary traffics, so users can decide which to use according to their network environment.11Para-Snort Performance12The SetupFor tcpdump tracesFor real traffictwo qua

9、d-core Xeon E5335 at 2.00GHz4 GB DRAMUbuntu 8.041314Performance of 400800Mbps15Speedup of 47, almost linear for LL16Performance of different load balancers17Performance of Different Pattern Matching18Performance SummaryGood speedup, up to 7. Performance up to 800MbpsM-JSQ is fastestAC-WM costs less memory, but slower19ConclusionsMulti-thread design fully utilizes multi-core CPUModular design, multifunction process modules, ea