Multi-threading in IDS

Question

I have to develop an IDS for my college project. java code for the sniffer and the algorithm is available to me. I have to enable it to support 1 GB Ethernet traffic/sec. To do so we plan to incorporate multi-threading and run the code on a dual core machine. i intend to make a separate thread for each client on the basis of IP. The main function of the program calls a method openInterface() of the class packetLoader {implements packetReciever} . the method openInterface() opens the NIC interface and starts capturing packets. should i alter this method of openInterface() to incorporate multi-threading? at which point should i start making threads? on the basis of what parameter should i make separate threads? how should i implement the required multi-threading?

cheers:)

public void openInterface(String filter, int numOfPackets){
    try {
        if (!devName.startsWith(NIC_NAME_PREFIX)) {             
            if(numOfPackets == -1)
                packetSamplingRatio = 1;
            else {
                packetSamplingRatio = numOfPackets/(double)totalPcapFilePackets;
            }
        }

        //JpcapCaptor captor = null;
        if (devName.startsWith(NIC_NAME_PREFIX)) {
                        System.err.println(".........inside openinterface");
            NetworkInterface[] devicesList = JpcapCaptor.getDeviceList();
                                         System.err.println(".........inside openinterface 2");

            String nicName = devName.substring(NIC_NAME_PREFIX.length());
            int nicID = -1;
            for (int i = 0; i < devicesList.length; i++) {

                                System.err.println(".........inside openinterface 3");
                if (devicesList[i].name.equals(nicName)){
                                        System.err.println("Device no:" + i + "=" +devicesList[i].name);
                                        System.err.println("capturing on device= " + devicesList[i].name);
                    nicID = i;}
            }
            if (nicID >= 0){

                                captor = JpcapCaptor.openDevice(devicesList[1],
                        NIC_SNAPLEN, true, NIC_TIMEOUT);
                            System.err.println(".........Device is open for packet capturing with");
                            System.err.println("NIC_SNAPLEN = " + NIC_SNAPLEN + " and NIC_TIMEOUT=" + NIC_TIMEOUT);

                            }
            else {
                System.err.println("Network interface " + nicName
                        + "cannot be found!");
                System.err.println("Availabel NICs:");
                for(int k=0; k<devicesList.length; k++) {
                    System.out.println("- " + devicesList[k]);
                }
                System.exit(1);
            }
        } else {
                        System.err.println(".........inside else");
            captor = JpcapCaptor.openFile(devName);
        }

        if (filter != null){
            captor.setFilter(filter, true);
                   ;
                    }// Start reading packets
                    System.err.println(".........filter checked");
                    //PacketStorage ps = new PacketStorage(); 
        //captor.loopPacket(numOfPackets, this);
                    //captor.processPacket(numOfPackets, this);
                    for(int j =0; j<numOfPackets ; j++){
                    captor.getPacket();

                    System.err.println(".........captured packet" + j);

                    }
                    System.err.println(".........after capture.looppacket");
    }

    catch (IOException e) {
        System.err.println("Exception in openDevice " + e);
        System.exit(1);
    }
}

Adam Dyga · Answer 1 · 2012-12-13T09:41:33.987

I'm not sure if I would spawn a new thread for each client (IP address). If it's only for college project it might be OK, but for more real scenarios it can be an overkill (and peformance hit) if the number of clients gets bigger. Instead, I would create a pool of worker threads (see java.util.concurrent.Executors and java.util.concurrent.ExecutorService) with fixed size (n+1 to 2*n of CPUs is a good start) and pass them the packets to be analyzed. In your case it could be done at the end of your code example in for loop where you call getPacket(). Of course the executor pool has to be initialized at application start.

Besides of all of this, generally implementing IDS is not something trivial, because to make it really right, it's not enough to analyze every packet individually. Due to IP fragmentation the packets come in fragments, so it may be necessary to merge a couple of them together to properly detect an intrusion. But that's different story out of the scope of your question...

Multi-threading in IDS

1 Answers1