MODELING AND EVALUATING THE IMPACT OF INTRUSION DETECTION SYSTEMS ON THE PERFORMANCE OF ISOLATED INFORMATION AND COMMUNICATION SYSTEMS
TL;DR
Significant performance drops are observed, including CPU exhaustion and denial of service for regular users during volumetric fragmentation attacks, showing that organizations must constantly refine their firewall policies and look into kernel-bypass technologies to keep their ICS networks running smoothly.
Abstract
Topicality. Today’s information and communication systems (ICS) face a growing number of complex cyber threats, making active defense mechanisms absolutely necessary. Yet, running these security tools constantly, especially Intrusion Detection and Prevention Systems (IDS/IPS), takes a toll on network bandwidth and creates heavy computational loads at the routing level. The subject of the study is the direct impact of IDS/IPS on the performance characteristics of an isolated network segment under various load conditions, with an emphasis on resource depletion due to fragmentation at layer 3 of the OSI model. The purpose of this work is to measure the real-world trade-off between security and performance. We aim to assess how much computational power is lost and precisely measure the latency caused by deep packet inspection and interrupt handling. The following results were obtained. We built a complete field-testing environment using isolated virtual machines. We carefully tracked packet processing latency and CPU usage across three states: a baseline with no security, standard traffic with IDS logging enabled, and a simulated high-volume fragmented DDoS attack. The data showed that a basic unprotected router uses very few resources (about 3% CPU, 2.2 ms latency). Turning on security rules bumped the latency to 4.3 ms. More importantly, when hit with a fragmented flood attack, the router’s CPU load spiked to 48%. This spike was mostly caused by the kernel handling software interrupts (ksoftirqd), which eventually caused legitimate packets to drop. Conclusion. Securing a network strongly increases the computational strain on the router. We observed significant performance drops, including CPU exhaustion and denial of service for regular users during volumetric fragmentation attacks. This shows that organizations must constantly refine their firewall policies and look into kernel-bypass technologies to keep their ICS networks running smoothly.