Increasing traffic and the necessity of stateful analyses impose strong computational requirements on network intrusion detection systems (NIDS), and motivate the need of distributed architectures with multiple sensors. In a context of high traffic with heavy tailed characteristics, static rules for dispatching traffic slices among distributed sensors cause severe imbalance. Hence, the distributed NIDS architecture must be combined with adequate mechanisms for dynamic load redistribution.In this paper, we propose and compare different policies for the activation/deactivation of the dynamic load balancer. In particular, we consider and compare single vs. double threshold schemes, and load representations based on resource measures vs. load aggregation models.Our experimental results show that the best combination of a double threshold scheme with a linear aggregation of resource measures is able to achieve a really satisfactory balance of the sensor loads together with a sensible reduction of the number of load balancer activations.

Dynamic load balancing for network intrusion detection systems based on distributed architectures / Andreolini, Mauro; Casolari, Sara; Colajanni, Michele; Marchetti, Mirco. - ELETTRONICO. - (2007), pp. 153-160. ((Intervento presentato al convegno 6th IEEE International Symposium on Network Computing and Applications, NCA 2007 tenutosi a Cambridge, MA nel 12/07/2007 [10.1109/NCA.2007.17].

Dynamic load balancing for network intrusion detection systems based on distributed architectures

ANDREOLINI, Mauro;CASOLARI, Sara;COLAJANNI, Michele;MARCHETTI, Mirco
2007

Abstract

Increasing traffic and the necessity of stateful analyses impose strong computational requirements on network intrusion detection systems (NIDS), and motivate the need of distributed architectures with multiple sensors. In a context of high traffic with heavy tailed characteristics, static rules for dispatching traffic slices among distributed sensors cause severe imbalance. Hence, the distributed NIDS architecture must be combined with adequate mechanisms for dynamic load redistribution.In this paper, we propose and compare different policies for the activation/deactivation of the dynamic load balancer. In particular, we consider and compare single vs. double threshold schemes, and load representations based on resource measures vs. load aggregation models.Our experimental results show that the best combination of a double threshold scheme with a linear aggregation of resource measures is able to achieve a really satisfactory balance of the sensor loads together with a sensible reduction of the number of load balancer activations.
6th IEEE International Symposium on Network Computing and Applications, NCA 2007
Cambridge, MA
12/07/2007
153
160
Andreolini, Mauro; Casolari, Sara; Colajanni, Michele; Marchetti, Mirco
Dynamic load balancing for network intrusion detection systems based on distributed architectures / Andreolini, Mauro; Casolari, Sara; Colajanni, Michele; Marchetti, Mirco. - ELETTRONICO. - (2007), pp. 153-160. ((Intervento presentato al convegno 6th IEEE International Symposium on Network Computing and Applications, NCA 2007 tenutosi a Cambridge, MA nel 12/07/2007 [10.1109/NCA.2007.17].
File in questo prodotto:
Non ci sono file associati a questo prodotto.
Pubblicazioni consigliate

Caricamento pubblicazioni consigliate

Licenza Creative Commons
I metadati presenti in IRIS UNIMORE sono rilasciati con licenza Creative Commons CC0 1.0 Universal, mentre i file delle pubblicazioni sono rilasciati con licenza Attribuzione 4.0 Internazionale (CC BY 4.0), salvo diversa indicazione.
In caso di violazione di copyright, contattare Supporto Iris

Utilizza questo identificativo per citare o creare un link a questo documento: http://hdl.handle.net/11380/420836
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 8
  • ???jsp.display-item.citation.isi??? 4
social impact