A study on effective hash-based load balancing scheme for parallel NIDS

Today, as network infrastructure is changing at a rapid rate to support high-speed and large-scale data transmission, several studies have been made on the design of NIDS for next-generation network environment. In large-scale network, there are too many traffic packets to be analysed in stand-alone system, thus NIDS should be organized with multiple intrusion detection nodes in parallel. An important issue on the parallel NIDS is that distributing network traffic without packet loss to each node in efficient way. Flow based load balancing scheme is one of these schemes. With this scheme, the efficiency and accuracy of analysis increase because packets belong to a flow are analysed not in multiple system but in only one system. This paper presents our flow based load balancing scheme which reflects characteristics of network traffic and performance of each NIDS node.