Cybersecurity and Networking: NIDS Front-End for Load Balancing at 100 Gigabits

Network Intrusion Detection Is a mission critical and computationally intensive application that needs to address future 100 Gbps networks. As the speed and complexity of networks increase, the challenge of intrusions, malicious attacks, and hostile activities is also increasing. Performance of existing solutions does not keep up with the increasing network speed. Today, even at 1 Gbps, commercial products falter under certain traffic conditions, thereby exposing users to attacks. NIDS cluster performance hinges on effective frontend load balancing at full line rate under any traffic conditions. New implementations should enable scalability of cost, complexity, and performance by silicon chip integration in Phase III. The focus of Phase II is robust front end balancing at full line rate with no compromise of performance under any traffic conditions. cPacket is utilizing its unique algorithmic fabric on a chip architecture, which has already been successfully deployed at Bro clusters for 10G networks, and extends it to 100G. The performance improvement is achieved by extending the algorithmic-fabric pipeline with first order partitioning logic, streamlining low level circuit design, adding 100 Gbps network interfaces, and implementing a complete 100 Gbps system that can be tested at full line rate and lends itself to further silicon integration and cost/power reduction in the future. cPacket collaborated with NIDS developers to create a functional requirements document. A feasibility assessment was conducted and the complete hardwaresoftware architecture and execution plan for the complete functional prototype at 100 Gbps in Phase II were developed. cPacket will deliver a working prototype performing at 100 Gbps full line rate and Deploy it in conjunction with actual Bro NIDS cluster in real 100G networks like ESnet. Commercial Applications and Other Benefits: The benefits include better security at high speed 100 Gbps networks, shorter down time, reduction in disruptions, and prevention of associated productivity losses. Using off-theshelf computing clusters with frontend load balancing reduces the overall cost of ownership and frees up energy, space, and resources for functionality and productivity improvements. The 100G frontend will be proliferated initially to government organizations, and will also benefit commercial organizations with similar requirements. The new balancing technology is also applicable in the longer run more broadly. I t can seed new models for load balancing cloud applications delivery in the future. The deterministic algorithmic fabric technology lends itself to a high degree of cost/performance scalability by integrated silicon chip implementations in the future, with a potential to completely change the economics and cost/performance benefits of clusters with frontend balancing.