mKIPS: A Lightweight Modular Kernel-Level Intrusion Detection and Prevention System

With many research results and the development of related tools, user-level intrusion detection and prevention systems (IDPS) have been widely used to defend systems against network attacks. However, there are still bottlenecks in their high packet drop rate and low detection efficiency under heavy network traffic. In contrast, kernel-level IDPS has a higher packet detection rate and higher efficiency, whereas kernel-level design faces many challenges. The system designed with the monolithic architecture has high performance. The dynamically loadable module architecture design has higher flexibility and scalability; however, the increased operating costs lower system performance. This paper explores the modular architecture of kernel-level IDPS that can expand or reconfigure system functions through dynamic plug-in modules and maintain the system’s stability and high performance. We have developed a lightweight, high-efficiency, scalable, and highly modular kernel-level IDPS named mKIPS. This modular architecture divides the system into several kernel modules, in which functional components can be dynamically inserted or removed during runtime to adapt to changing demands. Therefore, administrators can control the IDPS’s packet processing by mounting modules of different versions and functions for their needs. Besides, mKIPS dispatches packets to various cores for processing through software and hardware functions by properly setting the IRQ affinity and using Receive Packet Steering technology. As a result, the load of each core can be more balanced to utilize the multicores. Experimental results show that our mKIPS can achieve a high detection rate and efficiency.