A Stateful Real Time Intrusion Detection System for high-speed network

The Solutions of security are disturbed by aftermaths of the fast evolution of the infrastructure. Indeed, the new networks use more and more fast links in Gigabits and 10 Gigabits whereas the methods of security most often applied as IDSs, firewalls and cryptography are incapable to follow this fast transfer of data. In this paper, we are interested in the NIDSs. In fact the constant increase in network speed and throughput pose new challenges to these systems. Current NIDSs are designed to 10/100 Mbps [6], nevertheless large network installations are Gigabit Ethernet (1000 Mbps), so the task of detection becomes increasingly difficult with only one NIDS. The purpose of this paper is to discuss a new approach with the aim of accelerating the intrusion detection. The approach is based on three main steps: traffic classification, load balancing and a high availability mechanism. The paper describes all the above mentioned approaches and presents an experimental evaluation of their effectiveness.