Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study investigates the vulnerabilities of Host-based Intrusion Prevention Systems (IPS) that rely on application logs, demonstrating that common setups like Fail2Ban monitoring BIND9 can be easily circumvented by attackers generating less than 65 Mbps of DNS traffic. The authors introduce FIPS, a high-performance logging framework that utilizes per-thread lock-free shared memory ring buffers to minimize logging overhead and enhance throughput. Evaluation results reveal that FIPS not only logs more requests than existing frameworks but also enables the IPS to ban malicious clients 2.5 times faster while handling a massive load of attacking clients.
Attackers can bypass common IPS setups with minimal traffic, but a new logging framework can significantly enhance detection and response times.
Host-based Intrusion Prevention Systems (IPS) rely on application logs to detect and block malicious activity. However, on modern high-speed networks the logging subsystem itself becomes a bottleneck: an attacker can hide traces simply by generating enough traffic to overwhelm the application's log pipeline, dropping crucial traces. In this work, we show that widely deployed setups such as Fail2Ban monitoring BIND9 can be defeated with less than 65 Mbps of DNS traffic. Further, we show that when replacing core components of the IPS architecture with their higher-performance equivalent, iptables with eBPF and regex matching with Hyperscan, the logging backends themselves become the bottleneck. Therefore, we present FIPS, a new IPC designed for high-performance logging that bypasses the kernel and reduces copying of the log messages to a minimum. FIPS uses per-thread lock free shared memory ring buffers, supporting multiple independent consumers reading the same log stream at their own pace. FIPS offers both a native API and a drop-in replacement for the syslog interface. Our evaluation with BIND 9 shows that FIPS introduces almost no overhead compared to disabled logging, logs more requests than any other evaluated framework, and enables the IPS to ban malicious clients $2.5\times$ faster than with file logging while sustaining $2^{16}$ attacking clients at one million requests per second.