Abstract
As the types of attacks have increased noticeably, network security devices are more and more important in recent years. However, the growth rate of network bandwidth has been greater than that of processors’ performance. Even the most powerful general processors are not able to process packets at multiple gigabit wire speed. Consequently, it is desired to design next generation network systems for processing packets in parallel based on multi-processor platforms. In this thesis, a novel software architecture is proposed to enhance the performance of Network Intrusion Detection and Prevention Systems (NIPS). It’s beneficial for NIPS to run on platforms with large cache memory if frequently accessed data structures can be found in the cache memory. Although the processor is unlikely to equip with large cache memory, the performance can still be enhanced by reducing L2 cache missing rate. Another performance bottleneck is interrupt. It affects system performance in a negative way. Therefore, offloading interrupt handling is also helpful to improve performance. This thesis presents a mechanism to design an NIPS in multi-core platform based on processor affinity, interrupt affinity and stream affinity. The experimental results show that the proposed architecture really enhances the NIPS performance dramatically.