University of Bristol - Explore Bristol Research. Peer reviewed version. Link to published version (if available): /ICC.2006.

Transcription

1 Kaya, I., & Kocak, T. (2006). Energy-efficient pipelined bloo filters for network intrusion detection. IEEE International Conference on Counications, 5, DOI: /ICC Peer reviewed version Link to published version (if available): /ICC Link to publication record in Explore Bristol Research PDF-docuent University of Bristol - Explore Bristol Research General rights This docuent is ade available in accordance with publisher policies. Please cite only the published version using the reference above. Full ters of use are available:

2 Energy-Efficient Pipelined Bloo Filters for Network Intrusion Detection Ilhan Kaya and Taskin Kocak Departent of Electrical and Coputer Engineering University of Central Florida Orlando, FL e-ail: {ikaya, Abstract Software-based detection techniques are coonly used to identify the predefined signatures in network streas. However, the software-based techniques can not keep up with the speeds that network bandwidth increases. Hence, hardwarebased systes have started to eerge. Bloo filters are frequently used to identify alicious content like viruses in high speed networks. However, architectures proposed to ipleent Bloo filters are not power efficient. We propose a new Bloo filter architecture that exploits the well-known pipelining technique. Through extensive power analysis we show that pipelining can reduce the power consuption of Bloo filters up to 90 %, which leads to the energy-efficient ipleentation of network intrusion detection systes. I. INTRODUCTION Nowadays, there are plenty of software progras installed to keep coputer systes clean. Many of the are used in ipleentation of network intrusion detection systes(nids). These progras have to identify the alicious content such as internet wors and viruses in network packets. Applications providing intrusion detection, virus prevention, and content filtering have not kept pace with the increase in network speeds since they lack hardware functionality supporting the. There is a need to scan entire network packets bit by bit to deterine predefined signatures for viruses and wors. Before the packets are processed by the upper OSI layers, alicious packets has to be dropped by a device. Bloo filters [2] are used in such devices to atch strings, like snort rules [11]. Bloo filters have been used for any network applications like web cache sharing [6], resource routing [5], string atching [1] [7]. A hardware syste, consisting of Bloo filters to detect alignant content, is described in [7]. A detailed survey of Bloo filters for networking applications can be found in [3]. Although Bloo filters have found wide spread usage in networking applications, they are not conservative in ters of power. In order to decrease power consuption of Bloo filters, we eploy pipelining technique in the architecture of Bloo filters. The new type of Bloo filters are called as pipelined Bloo filters. In this paper, we propose a hardware syste consisting of pipelined Bloo filters as an energyefficient network intrusion detection syste. Furtherore, after atheatical analysis, intrusion detection syste is shown to be uch power efficient than the one consists of regular Bloo filters so far. II. PIPELINED BLOOM FILTERS In this section, first we introduce Bloo filters, and then we go on to explain pipelined Bloo filters architecture. Power analysis will follow in a coparative anner. A. Bloo Filters A Bloo filter is a data structure that stores a given set of signatures. In addition, it provides efficient ebership queries on the signature set. Two operations on the Bloo filters are defined as prograing and querying. Fig. 1. A Bloo Filter with k hash functions A typical Bloo filter is illustrated in Fig. 1. First, a Bloo filter coputes k any hash functions on each eber of the signature set. Consequently, it sets the bits on the -bit long lookup vector at the indices pointed by hash values. As for the querying, the Bloo filter coputes the sae hash functions used in the prograing for each input. Then it looks up the bit values located on the offsets (coputed hash values) on the bit vector, and, if it finds any bit unset at those addresses, it declares the input string to be a noneber of the signature set, which is called a isatch. Otherwise, if it finds all the bits are set, it concludes that input string ay be a eber of the signature set with a certain probability (false positive probability). This is called a atch. In [7], the false positive probability f is calculated by, ) k f = (1 e nk (1) /06/$20.00 (c) 2006 IEEE

3 where n is the nuber of signatures prograed into the bloo filter, is the length of the lookup vector, and k is the nuber of hash functions used to ipleent the Bloo filter. In addition, the authors find an optiu value of the nuber of hash functions, k=35, for an average nuber of bits allocated to per signature n = 50. Furtherore, they show that the false positive probability is on the orders of A single Bloo filter uses k any hash functions in order to ake a decision on the input. Hence the power consuption of a Bloo filter shown in Fig. 1 is a suation of the power consuptions of each of the hash functions, P Hi, with the lookup operation, P L, followed, plus an AND operation. P BFregular = (P Hi + P L )+P AND (2) Power consuption of an AND gate is ignored hereafter, since it is inial copared to the power used by the hash functions. The power consuption equation for a single Bloo filter siply becoes the total power used up by the hash functions and the power consued by querying the -bit vector for each hash value. P BFregular = (P Hi + P L ) (3) Hash functions used in the Bloo filters are generally of type universal hash functions [4]. The perforance of universal hash functions are explored by Raakrishna et al [9]. The power consuptions of different hash function ipleentations in hardware have been easured by Yuksel [12]. Yuksel akes use of the ulti-hashing [10] technique. Multi-hashing divides the input into saller pieces. Different universal hash functions fro the sae faily applied to these input pieces. Eventually results are concatenated to for the desired hash value without increasing the hash collision probability. Yuksel has coe up with different hash function ipleentations over word sizes of 64 bits, 32 bits, 16 bits. Aongst the different hash functions analyzed in [12], the ost power efficient hash function for a fixed frequency is Weighted NH Polynoial with Reduction, WH. This hash function is a derivative of the Universal Hash functions. Hence we use 16-bit, 32-bit, 64-bit WH faily of hash functions in the Bloo filters whenever hash functions are able to process the input fed to the syste. A WH faily of hash functions can process input as twice as longer than the word size used in ipleentation, for instance a 16-bit WH can process up to 32-bit strings including 32-bit input. In order to copare the power consuption of regular Bloo filters to that of a pipelined Bloo filter, we use 16- bit ipleentation of hash functions. All of the k any hash functions are of type 16-bit WH hash functions, so Equ. 3 becoes P BFregular = (P + P Hi(WH16 ) L)=k.(P WH16 + P L ) (4) B. Pipelined Bloo Filters Basically, a pipelined Bloo filter, as shown in Fig. 2, consists of two groups of hash functions. The first stage always coputes the hash values. By contrast, the second stage of hash functions only copute the hash values if in the first stage there is a atch between the input and the signature sought. Fig. 2. A 2-Stage pipelined Bloo filter The pipelined Bloo filters will have the sae nuber of hash functions as the regular Bloo filters. A pipelined Bloo filter exploits the virus free nature of the network traffic at ost of the tie. At worst, it will operate like a regular Bloo filter, which uses all of the hash functions before aking a decision on the type of the input. However, ost of the tie the first group of hash functions will result in a isatch. The advantage of using a pipelined Bloo filter is if the first stage catches a isatch, there is no need to use the second stage in order to decide whether the input string is a eber of the signature set. By following a siilar analysis of [8], we begin to derive the total power consuption of the pipelined Bloo filter. We assue that the hash functions used in each Bloo filter is perfectly rando. Overall, we have k-any rando universal hash functions in a pipelined Bloo filter. In the first stage, r-any of the are utilized. The nuber of signatures sought in a Bloo filter is given as n as before. Let us first derive the probability of atch in the first stage. The probability that a bit is still unset after all the signatures are prograed into the pipelined Bloo filter by using k- any independent hash functions is α. α = ( 1 1 ) kn e kn (for large ) (5) where 1 represents any one of the bits set by a single hash function operating on a single signature. Then ( ) 1 1 is the probability that the bit is unset after a single hash value coputation with a single signature. For it to reain unset, it should not be set by any of the k-any hash functions each 2383

4 operating on all of the n-any signatures in the signature set. Consequently, the probability that any one of the bits is set is (1 α) 1 e kn (6) In order for the first stage to produce a atch, the bits indexed by all r of the independent rando hash functions should be set. So the atch probability of the first stage is, represented as p, p = r (1 α) =(1 α) r (1 e kn ) r With a probability of (1-p) the first stage of the hash functions in the pipelined Bloo filter will produce a isatch. Otherwise, the first stage produces a atch, then the second stage is used to copare the input with the signature sought. Therefore the power consuption of a pipelined Bloo filter is given by P BF pipeline = P 1st stage + P {atch} P 2nd stage P BF pipeline = (P Hi + P L )+p (P Hj + P L ) (7) +P AND (8) By oitting P AND and selecting P Hi, j are of type 16-bit WH, and substituting Equ. 7 into Equ. 8 power consuption of a pipelined Bloo filter becoes P BFpipeline = (P + P Hi(WH16 ) L) +(1 e kn ) r = r.(p WH16 + P L )+ (P Hj(WH16 ) + P L) (1 e kn ) r (k r)(p WH16 + P L ) (9) The power saving ratio, PSR, in a single Bloo filter by deploying pipelining technique can be calculated as PSR = (P regular P pipelined ) Pregular (10) By substituting Equ. 4 and Equ. 9 into Equ. 10, the average power saving ratio, PSR, is given by ( [ ] ) k A r +(1 e kn ) r (k r) A PSR = k A (11) where A =(P WH16 +P L ). After siplifying As, PSR, is found out to be PSR = kn k r +(r k)(1 e ) r For different values of the nuber of bits allocated to per signature, n, power savings over the nuber of hash functions utilized in the first stage are illustrated in Fig. 3. k Power Saving Ratio, PSR /n=25 /n=50 /n= Nuber of hash functions in the first stage of pipelined Bloo filters, r Fig. 3. Power saving ratio in pipelined Bloo filters w.r.t. nuber of hash functions utilized in the first stage As it is shown in Fig. 3, the nuber of bits per signature, n, increases, the aount of power conserved in the syste increases. In other words, the power saving ratio becoes larger as n increases. This is because, the lesser are the nuber of hash functions deployed in first stage copared to the overall syste, the ore the power is saved. Another fact illustrated in Fig. 3 is that as the nuber of hash functions utilized in the first stage increases, the power saving ratio, PSR, first increases to an optiu PSR value, thereafter it drops gradually. The increase in the power saving ratio to an threshold value stes fro the fact that increasing the nuber of hash functions in the first stage increases the probability of isatch, thus second stage is not utilized to decide on an input. After this optiu is exceeded, PSR decreases steadily. If we increase the nuber of hash functions used in the first stage to such a degree that all hash functions in the syste deployed in the first stage, there reain no power gain at all (i.e., the syste behaves just like a regular Bloo filter.) III. POWER CONSUMPTION ANALYSIS OF AN INTRUSION DETECTION SYSTEM BASED ON PIPELINED BLOOM FILTERS In this section, we analyze the power consuption of a Bloo filter based NIDS given in [7]. The syste block diagra is illustrated in Fig. 4. The syste consists of parallel Bloo filters prograed to detect a group of predefined signatures. Each Bloo filter operates on a different length of input. The length of the input scanned by a Bloo filter is constricted by the length of the signature sought. All Bloo filters onitor the network traffic which enters into syste with a rate of one byte per cycle. Syste verifies whether there is a alicious content hidden in the packet payload. Power analysis of the syste follows in two sections. A. Syste relying on regular Bloo Filters In this case, the syste illustrated in Fig. 4 consists of regular bloo filters. Each Bloo filter operates on different length of inputs. Total power consuption of the syste is 2384

5 Fig. 4. Syste view of a Bloo filter engine [7] the suation of the power used by individual Bloo filters. There are (L ax L in ) Bloo filters in the syste. L ax is the axiu length of input, and L in is the iniu length of input processed by a Bloo filter. Hence the total power consuption is given by P TOTAL = L ax i=l in P BFi (14) where P BFi is the power dissipated through the i th Bloo filter. Let s develop the Equ. 14 as follows P TOTAL = P BFlin +P +P BF(lin +1) BF +...+P (lin +2) BF (l ax) (15) where P BFlin stands for the total power dissipated through the Bloo filter processing L in long input. Each Bloo filter in the syste takes different length inputs as pointed out before. By substituting Equ. 3 into the Equ. 14, P TOTAL = P lin + P (lin+1) +... P lax (16) P lin is the power dissipation of the i th hash function located inside the Bloo filter processing l in long input. We consider a syste with l in =3bytes and l ax = 32 bytes. We assue that lookup power is ignorable in the following analysis. We begin the analysis with calculating the power consuption of a 3-byte input processing Bloo filter. 3-byte input length is saller than 32-bit, which can be processed by a WH 16 type of hash function. We can divide the input into two halves. 8 bits are zero padded to the second half, which does not change the hash value coputed, since bitwise AND operation akes contribution of these bits 0. P BF3 byte = P Hi(WH 16) = k.p WH16 (17) Siilarly, 4-byte processing Bloo filter uses WH-16 type of hash functions without the input padding. P BF4 byte = P Hi(WH 16) = k.p WH16 (18) 5-byte are larger than 32 bits, and can t be processed by a WH 16. This type of input requires WH 32, which can process up to 8 byte. The reaining 24 bits are zero padded to the input. Hence, P BF5 byte = P Hi(WH 32) = k.p WH32 (19) A WH 32 is used in the construction of 6-byte, 7-byte and 8- byte long input processing Bloo filters. Power consuption of Bloo filters corresponding to these length input is equal to the 5-byte input processing Bloo filter. P BF6 byte = P Hi(WH 32) = k.p WH32 = P BF7 byte = P BF8 byte (20) As for the 9-byte input processing Bloo filter, a WH 32 can t be enough without ulti-hashing. Hence, WH 64 is needed with zero padded input. P BF9 byte = P Hi(WH 64) = k.p WH64 (21) Since a WH with a word size of 64 bit can process up to 128 bits long input, all the Bloo filters processing input in the range of 9 byte to 16 byte, including the 16 byte, can be ipleented with a WH 64. Their power consuptions are equal. P BF10 byte = P Hi(WH 64) = k.p WH64 P BF9 byte = P BF10 byte =... = P BF16 byte (22) After 128 bit long input we have to use the ulti-hashing ethod, and divide the input into 32 bit long and 128 bit long input, and ake zero padding if necessary until input length exceeds 160. By this way, it is possible that one WH 64 and one WH 16 will be enough to calculate hash function over 17 to 20 byte long inputs. So the power consuption of the Bloo filters operating on 17-byte to 20 byte long input is P BF17 byte = (P Hi(WH 64)+P Hi(WH 16)) = k.p WH64 + k.p WH16 P BF17 byte = P BF18 byte =... = P BF20 byte (23) In a siilar anner, again by aking use of ulti-hashing and zero padding whenever necessary, hash functions inside in Bloo filters operating on range of 21 to 24 byte input, ake use of one WH 64 and one WH 32. All the Bloo filters calculating hash values over the inputs fro 21 bytes long 2385

6 till 24 bytes, consues the sae power as 21-byte long input processing Bloo filter, which is shown below. P BF21 byte = (P Hi(WH 64)+P Hi(WH 32)) = k.p WH64 + k.p WH32 (24) = P BF21 byte = P BF22 byte =... = P BF24 byte 25-byte long input requires two WH 64 s. 200 bits exceed the capacity given by one WH 64 and one WH 32, which adds up to 24-byte input processing. Two WH 64 s are capable of processing 32-byte input strings, so all the Bloo filter engines operating on the range of input 25 bytes to 32 bytes long consues the sae aount of power. Again ulti-hashing is used to copute hash values over such long input streas. P BF25 byte = (P Hi(WH 64)+P Hi(WH 64)) =2.k.P WH64 P BF25 byte = P BF26 byte =... = P BF32 byte (25) By substituting the above values into the total power consuption Equ.16, power consuption of the Bloo filter engine shown in Fig. 4 is given as P TOTAL = P BF3 byte + P BF4 byte + P BF5 byte P BF(32 byte) P TOTAL = k.p WH16 + k.p WH16 + [3 4] k.p WH k.p WH32 [5 8] k.p WH k.p WH64 [9 16] k.(p WH64 + P WH16 ) k.(p WH64 + P WH16 ) + [17 20] k.(p WH64 + P WH32 ) k.(p WH64 + P WH32 ) + [21 24] 2.k.P WH k.(P WH64 ) (26) [25 32] which siplifies to Equ. 27 P TOTAL = k.(6.p WH16 +8.P WH P WH64 ) (27) B. Syste relying on pipelined Bloo Filters By following a siilar approach used in the regular Bloo filter analysis, we will calculate the total power consuption of the pipelined Bloo filter architecture shown in Fig. 4. The total power consuption in the syste is given as in Equ. 16. Each individual power consuption of pipelined Bloo filters is calculated based on the length of the input that enters into each pipelined Bloo filter. 3-byte long input is processed by a WH 16 owing to ultihashing. The power consuption of a pipelined 3-byte input processing Bloo filter, P PBF3 byte, can be calculated by using Equ. 8 P PBF3 byte = (P Hi(WH 16))+p + + P Hj(WH 16) = r.p WH16 + p.(k r)p WH16 (28) In order to process 4-byte input, WH 16 is used as hash function ipleentation. Hence, they consue the sae power as 3-byte input case. P PBF3 byte = P PBF4 byte (29) As for the 40 bits input, a WH 16 can not process the input, thus a WH 32 can handle that long input as uch as 64 bits long. As a result, 5-byte long input processing Bloo filter consues the sae power as 6, 7,and 8-byte long input processing ones. P PBF5 byte = (P Hi(WH 32))+p P Hj(WH 32) = r.p WH32 + p (k r)p WH32 P PBF5 byte = P PBF6 byte =... = P PBF8 byte (30) 9-byte input processing can not be handled with a WH 32, but a WH 64 type of hash function can handle as uch as 16- byte inputs, so all the Bloo filters processing input length of 9 to 16 bytes, are using a single WH 64 as hash function ipleentation. P PBF9 byte = (P Hi(WH 64))+p = r.p WH64 + p (k r)p WH64 P Hj(WH 64) P PBF9 byte = P PBF10 byte =... = P PBF16 byte (31) 17-byte input processing will require ulti-hashing, by using WH 64 and WH 16, in parallel, coputes hash values on input strings of length varying fro 17 to 20 bytes. P PBF17 byte = (P Hi(WH 64)+P Hi(WH 16))+ p = r.(p WH16 + P WH64 )+ (P Hj(WH 64) + P Hj(WH 16)) p (k r)(p WH16 + P WH64 ) P PBF17 byte = P PBF18 byte =... = P PBF20 byte (32) In a siilar anner, 21-byte to 24-byte input processing can be done by using a WH 64 and WH 32 in parallel due to the principle of ulti-hashing. Power consuption of 21 to 24 bytes long input processing Bloo filter is equal to each other and given by P PBF21 byte = (P Hi(WH 64)+P Hi(WH 32))+ p = r.(p WH32 + P WH64 )+ (P Hj(WH 64) + P Hj(WH 32)) p (k r)(p WH32 + P WH64 ) P PBF21 byte = P PBF22 byte =... = P PBF24 byte (33) 2386

7 25-byte long input requires two WH 64 in parallel. Pipelined Bloo filters operating in range 25 bytes to 32 bytes have the sae power consuption, and the power consuption is given by P PBF25 byte = (2.P Hi(WH 64))+ p (2.P Hj(WH 64)) = r.2.p WH64 + p (k r)2.p WH64 P PBF25 byte = P PBF26 byte =... = P PBF32 byte (34) Total power consuption of the syste consisting of pipelined Bloo filters is given by, P TOTAL = 6.[r + p(k r)].p WH [r + p(k r)].p WH [r + p.(k r)].p WH64 P TOTAL = [r + p.(k r)] (6P WH16 +8P WH32 +32P WH64 ) (35) By substituting p fro Equ. 7 into the total power consuption in Equ. 35, ] P TOTAL = [r +(1 e kn ) r (k r) (6P WH16 +8P WH32 +32P WH64 ) (36) After substituting the power consuption values of 16 bits, 32 bits, and 64 bits WH type of hash functions fro [12], the total power consuption of a pipelined Bloo filter based NIDS is plotted in Fig. 5. For different values of bits per signature, n, total power consuption vs. nuber of hash functions in the first stage is illustrated. The total power consuption iniized for all of the n values when the nuber of hash functions in the first stage is approxiately 5. Before this threshold value, the atch probability is such large that ost of the tie second stage of hash functions are used to deterine the outcoe of the filter, so the total power consuption increases. After the threshold value, the nuber of hash functions utilized in the first stage increases, which results in the increase of the overall the power consuption of the syste. IV. CONCLUSION We propose to pipeline the hash functions in the Bloo filters that are used in network intrusion detection systes. Analytical results show that pipelining technique significantly decreases the total power consuption of a Bloo filter up to 90%. These type of Bloo filters are especially power efficient when the network is not alignantly congested. It is shown that the less the nuber of hash functions is ipleented in the fist stage of a pipelined Bloo filter, the ore the power consuption is. It is also true that the nuber of bits allocated to per signature, n, affects the power saving ratio in a pipelined Bloo filter. The pipelined Bloo filters are ore Total Power Consuption, µw Total Power Consuption, µw /n=100 /n=50 /n= Nuber of hash functions in the first stage, r /n=100 /n=50 /n= Nuber of hash functions in the first stage, r Fig. 5. Total power consuption w.r.t. the nuber of hash functions utilized in the first stage appropriate when ipleenting network intrusion detection systes, since they are consuing less power copared to the regular Bloo filters. The selection of the hash functions to be deployed in the first stage of a pipelined Bloo filter is another crucial aspect, and it is left as a future work. REFERENCES [1] M. Attig, S. Dharapurikar, and J.L. Lockwood. Ipleentation Results of Bloo Filters for String Matching, Proc. of IEEE Syposiu on Field-Prograable Custo Coputing Machines, pp Washington, DC., [2] B. Bloo, Space/Tie Trade-Offs in Hash Coding with Allowable Errors, Coun. ACM, vol. 13, no. 7, pp , July [3] A. Broder and M. Mitzenacher, Network Applications of Bloo Filters: A Survey, Internet Matheatics, vol. 1, no. 4, pp , July [4] J. L. Carter and M. Wegan, Universal classes of hash functions, Journal of Coputer and Syste Sciences, vol. 18, pp , [5] S. Czerwinski, B. Y. Zhao, T. Hodes, A. D. Joseph, and R. Katz. An Architecture for a Secure Service Discovery Service, Proc. ACM/IEEE International Conference on Mobile Coputing and Networking Transactions on Networking, pp New York, [6] L. Fan, P. Cao, J. Aleida, A. Z. Broder. Suary Cache: A Scalable Wide-Area Web Cache Sharing Protocol, IEEE/ACM Transactions on Networking, vol. 8, no. 3, pp , [7] S. Dharapurikar, P. Krishnaurthy, T.S. Sproull, and J. W. Lockwood, Deep Packet Inspection Using Parallel Bloo Filters, IEEE Micro, vol. 24, no. 1, pp , [8] M. Mitzenacher, Copressed Bloo filters, IEEE/ACM Transactions on Networking, vol. 10, no. 5, pp , October, [9] M. Raakrishna, E. Fu, and E. Bahcekapili, Efficient Hardware Hashing Functions for High Perforance Coputers, IEEE Transactions on Coputers, vol. 48, no. 12, pp , [10] P. Rogaway, Bucket Hashing and Its Application to Fast Message Authentication, Journal of Cryptology, vol. 12, no. 2, pp , [11] The Sourcefire Vulnerability Research Tea, Official Snort Ruleset, Sourcefire, Inc., Colubia, MD, August (web: [12] K. Yuksel, Universal Hashing for Ultra-Low-Power Cryptographic Hardware Applications, MS Thesis,Worcester Polytechnic Institute,