FlexIPS: A Keep Tracking Scalable Network Function Design and Implementation

From the past to the present, network attack methods have not been unchanged. As network technology is becoming increasingly complex, the difficulty of preventing risks has also increased. Attack methods have ranged from early packet spoofing, flood attacks, vertical scanning, to social attacks, such as horizontal scanning and spam. Up to the recent web application attacks, web injection attacks, penetration attacks, and ransomware that caused a large amount of economic lossesnot long ago have forced computer scientists to pay attention to the prevention of information security incidents. Intrusion prevention systems (IPSs), also known as intrusion detectionand prevention systems, are used for maintaining network security. Their purpose is to reinforce the deficiencies of network firewalls and network intrusion detection systems and strengthen network safety. IPSs can monitor the network status and transmission behavior of network packets inreal time and interrupt, adjust, or isolate abnormal or malicious network packet transmission behaviors in real time. In this study, a scalablesoftware-based IPS based on Hy-perscan, Data Plane Develop Kit (DPDK), and OpenNetVM is designed and implemented. With these libraries, it achieves a dynamic scalable IPS that can filter out malicious patterns spread all over the packet flow. Moreover, a methodcalled back pressure is designed and implemented to increase the performance of the IPS. Finally, the performance of the IPS is evaluated on a 10-Gbps network environment using iperf, Pktgen-DPDK, and malicious pcap files with Snort community rules.