Researchers Say Theyve Developed Fastest Open Source IDS/IPS

With a five-processor core, Pigasus delivers the same performance as a system with between 100 and 700 cores, according to a team from Carnegie Mellon Universitys CyLab.

Researchers at Carnegie Mellon Universitys CyLab security and privacy institute have devised what they say is the worlds fastest open source intrusion detection and prevention system (IDS/IPS).
Presenting their work at the
USENIX Symposium on Operating Systems Design and Implementation
earlier this month, the researchers described their invention, named Pigasus, as achieving speeds of 100 Gbps using a single five-processor core server and a field programmable gate array (FPGA). Typically that kind of performance would require between 100 and 700 processor cores and a whole rack of systems, the researchers said. According to the researchers, their approach uses 38 times less power than a CPU-only IDS/IPS.
FPGAs are integrated circuits that can be configured after manufacture to perform a variety of different processing tasks, which is unlike typical CPUs where the functions are already fully baked in. FPGAs are often used to boost a computing systems performance in a variety of ways, including by offloading certain tasks from the CPU and executing them separately. Big cloud vendors like Amazon Web Services and Microsoft use FPGAs to bolster storage and network performance, among other things, especially for demanding high-performance computing (HPC) applications.
The FPGA in CyLabs
Pigasus system
is programmed to detect network intrusions using algorithms that are much faster than those available with typical IDS/IPS, according to the researchers. The FPGA can inspect some 95% of data traffic on a network on its own for signs of malware and malicious activity, while the remaining 5% is handled by the servers five processor cores.
Justine Sherry, assistant professor at CMUs school of computer science, says the project is designed to demonstrate a more cost-effective approach to inspecting Internet traffic for malicious activity than current approaches. With Internet services continuously producing more data, organizations are under pressure to find new, cost-effective ways of monitoring the traffic.
Todays line rates can be 100 Gbps or even higher, Sherry says. Securing computer networks requires monitoring all of this traffic for malicious content.
Unfortunately, for most organizations, monitoring 100 Gbps or more is extremely expensive in terms of equipment and power, Sherry says. As a result, some organizations these days only sample traffic and send it through an IDS/IPS to keep a lid on costs.
We show in our research paper that using Snort 3.0, a software IDS would require anywhere from 70 to 677 processor cores to keep up with 100 Gbps, she notes. Our hope is that Pigasus can help bring the cost of detection down and make it feasible to do more comprehensive monitoring for these networks.
For the moment, Pigasus remains a research project. CyLab researchers used network traces from real deployments to test the system. But it has not been put through a live operational network yet.
CyLab is working on pushing the project code to the open source community so others can use it for free. CMU is also collaborating with researchers at the University of Virginia and the University of Maryland on ways to improve the system. Others are taking Pigasus apart for other use cases, Sherry said, without elaborating.
Commercialization remains an open question for our team to discuss in the future, she says.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Researchers Say Theyve Developed Fastest Open Source IDS/IPS