Possibilities of using of hardware accelerators for intrusion detection and prevention systems

2024

Авіаційно-космічна техніка та технологія, Vol 0, Iss 6, Pp 94-102 (2024)

The subject of this study is the capabilities of FPGA technology for cybersecurity solutions with the network interface accelerators of SmartNIC, as well as the technologies for building, deploying, supporting, and accelerating intrusion detection systems and intrusion prevention systems. The goal of this work is to increase the performance of the network protection components of modern datacenters using hardware network interface accelerator cards based on FPGA technology. The task is to analyze the classification of cyber threats, to analyze methods of detecting cyber threats, to analyze the capabilities of modern FPGA accelerator cards for the creation of SmartNICs, to propose the architecture for hardware implementation of intrusion prevention system based on FPGA accelerator cards, and to propose the sequence of steps for creation of hardware implementation of intrusion prevention system based on FPGA acceleration. According to the tasks, the following results were obtained. The analysis of the main categories of common cyberthreats that should be considered when creating systems is performed. Two main principles of intrusion detection including the signature method and the anomaly detection method are analyzed. The analysis of the possibilities of using FPGA accelerator cards for hardware acceleration of network interfaces and the creation of SmartNICs is performed. The architecture of hardware implementation of network interface components for intrusion prevention system based on FPGA accelerator cards in data centers is proposed. The sequence of steps for creation of FPGA-based implementation of intrusion prevention system is proposed. Conclusions. The scientific novelty of the obtained results is in the fact that the analysis of the specifics of cyberthreats of datacenters and capabilities of FPGA accelerator cards with support of high-speed network interfaces allows to propose the set of recommendations for the creation of intrusion detection systems and intrusion prevention systems with the transfer of work to hardware implementation, which will make it possible to offload the computing resources of server and thereby increase its performance. The software component of the solution provides the possibility of improvements and continuously updating the operating profile of the hardware component of such intrusion detection and intrusion prevention systems directly in the system.

article

English
Ukrainian

National Aerospace University «Kharkiv Aviation Institute», 2024.

система виявлення вторгнень, система запобігання вторгненням, ids, ips, smartnic, fpga як сервіс, розвантаження ресурсів датацентрів, Motor vehicles. Aeronautics. Astronautics, TL1-4050