Performance Analysis Of Different Hash Functions Using Bloom Filter For Network Intrusion Detection Systems In 32-Bit And 64-Bit Computer Operation Mode.

• Auteur principal: Tan , Beng Ghee
• Format: Thèse
• Langue: anglais
• Publié: 2016
• Sujets: TK7800-8360 Electronics
• Accès en ligne: http://eprints.usm.my/41308/

A Network Intrusion Detection System (NIDS) is an application or device that screens the network traffics for malicious activities or any violation in the network policy. In current Gigabit per second (Gbps) networking speed, the NIDS needs to be very fast and efficient. Bloom Filter is a key component within the NIDS that contribute to the speed of the system. A Bloom Filter is an array of bits that determine whether a given structure of information belongs to it. A Bloom Filter pattern matching algorithm with fast hashing functions is developed for 32-bit and 64-bit computer system. The implemented hashes are Murmur2 Hash, City Hash, One-at-a-time Hash, SuperFast Hash, and Lookup3 Hash. The developed system’s functionality is verified. Performance evaluation data shows that the Bloom Filter with SuperFast Hash is the fastest among all the Bloom Filter Variants that were under test. Experiment result also indicates that the Bloom Filter executes faster in 64-bit Mode as compared to 32-bit Mode, regardless of the hash. All the Bloom Filter Variants meet the projected false positive rate (0.1%) that were initialized. The Bloom Filter with City Hash recorded lowest false positive rate among all the Bloom Filter Variants.