A Framework For Performance Evaluation Of ASIPS In Network-Based IDS

TL;DR

This paper presents a framework for evaluating the performance of application-specific instruction set processors in network-based intrusion detection systems, demonstrating significant improvements through compiler optimizations across various microprocessors.

Contribution

It introduces a novel framework for analyzing and enhancing the performance of IDPS hardware using specific microprocessors and compiler optimizations, including a new optimization flag combination.

Findings

18.10% performance improvement on ARM7TDMI microprocessors

Framework applicable to multiple microprocessors for IDPS performance evaluation

Compiler optimization levels significantly impact IDPS processing efficiency

Abstract

Nowadays efficient usage of high-tech security tools and appliances is considered as an important criterion for security improvement of computer networks. Based on this assumption, Intrusion Detection and Prevention Systems (IDPS) have key role for applying the defense in depth strategy. In this situation, by increasing network bandwidth in addition to increasing number of threats, Network-based IDPSes have been faced with performance challenge for processing of huge traffic in the networks. A general solution for this bottleneck is exploitation of efficient hardware architectures for performance improvement of IDPS. In this paper a framework for analysis and performance evaluation of application specific instruction set processors is presented for usage in application of attack detection in Networkbased Intrusion Detection Systems(NIDS). By running this framework as a security application on V850, OR1K, MIPS32, ARM7TDMI and PowerPC32 microprocessors, their performance has been evaluated and analyzed. For performance improvement, the compiler optimization levels are employed and at the end; base on O2 optimization level a new combination of optimization flags is presented. The experiments show that the framework results 18.10% performance improvements for pattern matching on ARM7TDMI microprocessors.