GLoP: Enabling Massively Parallel Incident Response Through GPU Log Processing

Research output: Chapter in Book/Report/Conference proceedingConference contribution book

4 Citations (Scopus)

Abstract

Large industrial systems that combine services and applications, have become targets for cyber criminals and are challenging from the security, monitoring and auditing perspectives. Security log analysis is a key step for uncovering anomalies, detecting intrusion, and enabling incident response. The constant increase of link speeds, threats and users, produce large volumes of log data and become increasingly difficult to analyse on a Central Processing Unit (CPU). This paper presents a massively parallel Graphics Processing Unit (GPU) Log Processing (GLoP) library and can also be used for Deep Packet Inspection (DPI), using a prefix matching technique, harvesting the full power of off-the-shelf technologies. GLoP implements two different algorithm using different GPU memory and is compared against CPU counterpart implementations. The library can be used for processing nodes with single or multiple GPUs as well as GPU cloud farms. The results show throughput of 20 Gbps and demonstrate that modern GPUs can be utilised to increase the operational speed of large scale log processing scenarios, saving precious time before and after an intrusion has occurred.
LanguageEnglish
Title of host publicationSIN '14 Proceedings of the 7th International Conference on Security of Information and Networks
DOIs
Publication statusPublished - Sep 2014
Event7th International Conference on Security of Information and Networks - UK, Glasgow, United Kingdom
Duration: 9 Sep 201411 Sep 2014

Conference

Conference7th International Conference on Security of Information and Networks
CountryUnited Kingdom
CityGlasgow
Period9/09/1411/09/14

Fingerprint

Processing
Program processors
Farms
Graphics processing unit
Inspection
Throughput
Data storage equipment
Monitoring

Keywords

  • cyber security
  • cyber crime
  • central processing unit
  • CPU
  • GPU memory

Cite this

Bellekens, X. J. A., Tachtatzis, C., Atkinson, R. C., Renfrew, C., & Kirkham, T. (2014). GLoP: Enabling Massively Parallel Incident Response Through GPU Log Processing. In SIN '14 Proceedings of the 7th International Conference on Security of Information and Networks https://doi.org/10.1145/2659651.2659700
Bellekens, Xavier J.A. ; Tachtatzis, Christos ; Atkinson, Robert C. ; Renfrew, Craig ; Kirkham, Tony. / GLoP : Enabling Massively Parallel Incident Response Through GPU Log Processing. SIN '14 Proceedings of the 7th International Conference on Security of Information and Networks . 2014.
@inproceedings{2211e808655a40759ceb9cbeba48e109,
title = "GLoP: Enabling Massively Parallel Incident Response Through GPU Log Processing",
abstract = "Large industrial systems that combine services and applications, have become targets for cyber criminals and are challenging from the security, monitoring and auditing perspectives. Security log analysis is a key step for uncovering anomalies, detecting intrusion, and enabling incident response. The constant increase of link speeds, threats and users, produce large volumes of log data and become increasingly difficult to analyse on a Central Processing Unit (CPU). This paper presents a massively parallel Graphics Processing Unit (GPU) Log Processing (GLoP) library and can also be used for Deep Packet Inspection (DPI), using a prefix matching technique, harvesting the full power of off-the-shelf technologies. GLoP implements two different algorithm using different GPU memory and is compared against CPU counterpart implementations. The library can be used for processing nodes with single or multiple GPUs as well as GPU cloud farms. The results show throughput of 20 Gbps and demonstrate that modern GPUs can be utilised to increase the operational speed of large scale log processing scenarios, saving precious time before and after an intrusion has occurred.",
keywords = "cyber security, cyber crime, central processing unit, CPU, GPU memory",
author = "Bellekens, {Xavier J.A.} and Christos Tachtatzis and Atkinson, {Robert C.} and Craig Renfrew and Tony Kirkham",
year = "2014",
month = "9",
doi = "10.1145/2659651.2659700",
language = "English",
isbn = "978-1-4503-3033-6",
booktitle = "SIN '14 Proceedings of the 7th International Conference on Security of Information and Networks",

}

Bellekens, XJA, Tachtatzis, C, Atkinson, RC, Renfrew, C & Kirkham, T 2014, GLoP: Enabling Massively Parallel Incident Response Through GPU Log Processing. in SIN '14 Proceedings of the 7th International Conference on Security of Information and Networks . 7th International Conference on Security of Information and Networks, Glasgow, United Kingdom, 9/09/14. https://doi.org/10.1145/2659651.2659700

GLoP : Enabling Massively Parallel Incident Response Through GPU Log Processing. / Bellekens, Xavier J.A.; Tachtatzis, Christos; Atkinson, Robert C.; Renfrew, Craig; Kirkham, Tony.

SIN '14 Proceedings of the 7th International Conference on Security of Information and Networks . 2014.

Research output: Chapter in Book/Report/Conference proceedingConference contribution book

TY - GEN

T1 - GLoP

T2 - Enabling Massively Parallel Incident Response Through GPU Log Processing

AU - Bellekens, Xavier J.A.

AU - Tachtatzis, Christos

AU - Atkinson, Robert C.

AU - Renfrew, Craig

AU - Kirkham, Tony

PY - 2014/9

Y1 - 2014/9

N2 - Large industrial systems that combine services and applications, have become targets for cyber criminals and are challenging from the security, monitoring and auditing perspectives. Security log analysis is a key step for uncovering anomalies, detecting intrusion, and enabling incident response. The constant increase of link speeds, threats and users, produce large volumes of log data and become increasingly difficult to analyse on a Central Processing Unit (CPU). This paper presents a massively parallel Graphics Processing Unit (GPU) Log Processing (GLoP) library and can also be used for Deep Packet Inspection (DPI), using a prefix matching technique, harvesting the full power of off-the-shelf technologies. GLoP implements two different algorithm using different GPU memory and is compared against CPU counterpart implementations. The library can be used for processing nodes with single or multiple GPUs as well as GPU cloud farms. The results show throughput of 20 Gbps and demonstrate that modern GPUs can be utilised to increase the operational speed of large scale log processing scenarios, saving precious time before and after an intrusion has occurred.

AB - Large industrial systems that combine services and applications, have become targets for cyber criminals and are challenging from the security, monitoring and auditing perspectives. Security log analysis is a key step for uncovering anomalies, detecting intrusion, and enabling incident response. The constant increase of link speeds, threats and users, produce large volumes of log data and become increasingly difficult to analyse on a Central Processing Unit (CPU). This paper presents a massively parallel Graphics Processing Unit (GPU) Log Processing (GLoP) library and can also be used for Deep Packet Inspection (DPI), using a prefix matching technique, harvesting the full power of off-the-shelf technologies. GLoP implements two different algorithm using different GPU memory and is compared against CPU counterpart implementations. The library can be used for processing nodes with single or multiple GPUs as well as GPU cloud farms. The results show throughput of 20 Gbps and demonstrate that modern GPUs can be utilised to increase the operational speed of large scale log processing scenarios, saving precious time before and after an intrusion has occurred.

KW - cyber security

KW - cyber crime

KW - central processing unit

KW - CPU

KW - GPU memory

U2 - 10.1145/2659651.2659700

DO - 10.1145/2659651.2659700

M3 - Conference contribution book

SN - 978-1-4503-3033-6

BT - SIN '14 Proceedings of the 7th International Conference on Security of Information and Networks

ER -

Bellekens XJA, Tachtatzis C, Atkinson RC, Renfrew C, Kirkham T. GLoP: Enabling Massively Parallel Incident Response Through GPU Log Processing. In SIN '14 Proceedings of the 7th International Conference on Security of Information and Networks . 2014 https://doi.org/10.1145/2659651.2659700