Abstract
Most past and present intrusion detection systems architectures
assume a uni-processor environment or do not explicitly make use of
multiple processors when they exist. Yet, especially in the server
world, multiple processor machines are commonplace; and with the
advent of technologies such as Intel and AMD's multi-core or
Hyperthreading technologies, commodity computers are likely to have
multiple processors.
This research explores how explicitly dividing the system into
production and security components and running the components in
parallel on different processors can improve the effectiveness of
the security system. The production component contains all user
tasks and most of the operating system while the security component
contains security monitoring and validating tasks and the parts of
the O/S that pertain to security. We demonstrate that under some
circumstances this architecture allows intrusion detection systems
to use monitoring models with higher fidelity, particularly with
regard to the timeliness of detection, and will also increase system
robustness in the face of some types of attacks.
Empirical results with a prototype co-processing intrusion detection
system (CuPIDS) architecture support the feasibility of this
approach. The construction of the prototype allowed us to
demonstrate the implementation costs of the architecture are
reasonable. Experimentation using fine-grained protection of
real-world applications resulted in about a fifteen percent slowdown
while demonstrating CuPIDS' ability to quickly detect and respond to
illegitimate behavior.
