Gnort: High Performance Network Intrusion Detection Using Graphics Processors

October 26th, 2008

This paper presents an intrusion detection system based on the Snort open-source NIDS that exploits the underutilized computational power of modern graphics cards to offload the costly pattern matching operations from the CPU, and thus increase the overall processing throughput. The prototype system, called Gnort, achieved a maximum traffic processing throughput of 2.3 Gbit/s using synthetic network traces, while when monitoring real traffic using a commodity Ethernet interface, it outperformed unmodified Snort by a factor of two. The results suggest that modern graphics cards can be used effectively to speed up intrusion detection systems, as well as other systems that involve pattern matching operations. (Gnort: High Performance Network Intrusion Detection Using Graphics Processors. G. Vasiliadis, S. Antonatos, M. Polychronakis, E. P. Markatos, and S. Ioannidis. In Proceedings of the 11th International Symposium On Recent Advances In Intrusion Detection (RAID), 2008)

Leave a Comment