Kittitornkun, Surin

Preferred name

Kittitornkun, Surin

Alternative Name

Kittitornkun, S.

Main Affiliation

School of Engineering

surin.ki@kmitl.ac.th

Now showing 1 - 10 of 39

Some of the metrics are blocked by your
consent settings
Applying Cuckoo Hashing for FPGA-based pattern matching in NIDS/NIPS
(2007-12-01)
Thinh, Tran Ngoc
;
Kittitornkun, Surin
;
Tomiyama, Shigenori
Pattern matching for network intrusion/prevention detection requires extremely high throughput with frequent updates to support new attack patterns. Most of current hardware implementations have outstanding performance over software implementations. However, the requirement for dynamic update pattern set is still challenging for hardware researchers. This paper describes a novel FPGA-based pattern matching architecture using a recent hashing algorithm called Cuckoo Hashing. The proposed architecture features on-the-fly pattern updates without reconfiguration, more efficient hardware utilization, and higher performance. Through various algorithmic changes of Cuckoo Hashing, we can implement parallel pattern matching on SRAM-based FPGA. Our system can accommodate the latest Snort rule-set, an open source Network Intrusion Detection/Prevention System, and achieve the highest utilization in terms of SRAM per character and Logic Cells per character at 17 bits/character and 0.043 Logic Cells/character, respectively on major Xilinx Virtex architectures. Compared to others, ours is much more efficient than any other Xilinx FPGA architectures. © 2007 IEEE.
Some of the metrics are blocked by your
consent settings
A FPGA-based deep packet inspection engine for network intrusion detection system
(2012-10-02)
Thinh, Tran Ngoc
;
Hieu, Tran Trung
;
Dung, Van Quoc
;
Kittitornkun, Surin
Pattern matching has became a bottleneck of software based Network Intrusion Detection System (NIDS) as the number of signature have recently increased dramatically. Many FPGA-based architectures for detecting malicious patterns have been proposed recently. However, these approaches have just considered matching pattern separately while more and more complex combination of several patterns are utilized to describe intrusion activities. In this paper we present our work which concentrates on multi-pattern signature and propose a FPGA-based deep packet inspection engine for NIDS. The system can support both static and dynamic patterns. We employ Snort signature set and realize our system on NetFPGA platform. The evaluation on real network environment shows that our system can maintain gigabit line rate throughput without dropping packets. © 2012 IEEE.
Some of the metrics are blocked by your
consent settings
A MultiStack Parallel (MSP) partition algorithm applied to sorting
(2020-09-09)
Rattanatranurak, Apisit
;
Kittitornkun, Surin
The CPUs of smartphones are becoming multicore with huge RAM and storage to support a variety of multimedia applications in the near future. A MultiStack Parallel (MSP) sorting algorithm is proposed and named MSPSort to support manycore systems. It can be regarded as many threads of single-pivot interleaving block-based Hoare’s algorithm. Each thread performs compare-swap operations between left and right (stacked and interleaved) data blocks. A number of multithreading features of OpenMP and our own optimization strategies have been utilized. To simulate those smartphones, MSPSort is fine tuned and tested on four Linux systems, e.g. Intel i7-2600, Xeon X5670, AMD R7-1700 and R9-2920. Their memory configurations can be classified as either uniform or non-uniform memory access. The statistical results are satisfied compared to parallel-mode sorting algorithms of Standard Template Library, namely Balanced QuickSort and MultiWay MergeSort. Moreover, MSPSort looks promising to be developed further to improve both run time and stability.
Some of the metrics are blocked by your
consent settings
Systolic array for string matching in NIDS
(2007-12-01)
Thinh, Tran Ngoc
;
Kittitornkun, Surin
In this paper, the rule set of a Network Intrusion Detection System, SNORT [1], is deeply analyzed and a compact encoding method to reduce the memory space for storing the payload content strings of entire rules is proposed. This method can approximately reduce up to 50% of area cost when compared with traditional ASCII coding method. After that, we implement a reconfigurable hardware sub-system for Snort payload matching using systolic design technique. Our system is a processor array architecture that can match strings with throughput up to 3.86 Gbps and area efficient manner.
Some of the metrics are blocked by your
consent settings
Performance analysis & improvement of SNPHAP on Multi-core CPUs
(2013-09-02)
Ranokphanuwat, Ratthaslip
;
Kittitornkun, Surin
;
Tongsima, Sissades
In this paper, we attempt to analyse this highly computational problem by parallelizing a haplotype inference algorithm, called SNPHAP. The analysis is based on both the orignal (sequential) algorithm and its corresponding run time complexity in Big-O notations. Then, we improve its performance using OpenMP 3.0 and test on a 4-core Intel Core i7-2600 (Hyper-Threading), an 8-core Intel XeonE5405, an 8-core Intel Xeon E5520 (Hyper-Threading) and a 32-core AMD Opteron 8356 Linux machines. The achievements in terms of maximum speedups are 260%, 316%, 410% and 488%, respectively. The factors that affect the speedup of SNPHAP are the specific parallelized code fraction, the suitable OpenMP constructs, the number of physical cores, the sizes of cache memories within/among CPU cores, the clock frequency and finally the memory technology. © 2013 IEEE.
Some of the metrics are blocked by your
consent settings
A Spatio-Temporal malware and country clustering algorithm: 2012 IIJ MITF case study
(2017-10-01)
Sisaat, Khamphao
;
Kittitornkun, Surin
;
Kikuchi, Hiroaki
;
Yukonhiatou, Chaxiong
;
Terada, Masato
A huge number of botnet malware variants can be downloaded by zombie personal computers as secondary injections and upgrades according to their botmasters to perform different distributed/coordinated cyber attacks such as phishing, spam e-mail, malicious Web sites, ransomware, DDoS. In order to generate a faster response to new threats and better understanding of botnet activities, grouping them based on their malicious behaviors has become extremely important. This paper presents a Spatio-Temporal malware clustering algorithm based on its (weekly-hourly-country) features. The dataset contains more than 32 million of malware download logs from 100 honeypots set up by Malware Investigation Task Force (MITF) of Internet Initiative Japan Inc. (IIJ) from 2011 to 2012. The Top-20 malware clustering results coincidentally correspond to Conficker.B and Conficker.C with relatively high precision and recall rates up to 100.0, 88.9 % and 91.7, 100.0 %, respectively. On the other hand, the resulting two clusters of Top-20 countries are comparable to those with high and low growth rates recently reported in 2015 by Asghari et al. Therefore, our approach can be validated and evaluated to yield precision and recall of up to 75.0 and 86.7 %, respectively.
Some of the metrics are blocked by your
consent settings
Geographical visualization of malware download for anomaly detection
(2012-11-06)
Hiroguchi, Naoki
;
Sisaat, Khamphao
;
Kikuchi, Hiroaki
;
Kittitornkun, Surin
We study a linkage between attacks in cyberspace and incidents in our real world. For example, the Internet had been closed down in Egypt for preventing protests against President Hosni Mubarak. Meanwhile, for more than two weeks we have observed that no port-scan packet were sent from Egypt to Japan. This motivates us for this study to find any incident between botnet attacks which were involved many vulnerable servers and the real events occurred in the world. For this purpose, we developed the virtualization system on Google Earth service for plotting source IP addresses of botnet communications. We investigated the actual malware downloading events observed by more than 70 distributed honey pots in the Japanese backbone network. In order to automate the detection process, we study some anomaly detection schemes base on the entropy of honey pot activities. Our analysis shows some evidences that botnet attacks are involved in our real world. © 2012 IEEE.
Some of the metrics are blocked by your
consent settings
Power optimization for mobile MPEG-4 video decoder
(2005-12-01)
Pakdeepaiboonpol, Pairoj
;
Kittitornkun, Surin
Most compiler optimization techniques concern most about speed. In this paper, we present two high-level power/energy optimization methods for ARM-based battery-powered embedded multimedia systems, e.g. mobile phones, pocket PCs, personal multimedia systems, etc. The experiments using MPEG-4 simple profile level 0 (SP@LO) video decoder on ARM920T with two QCIF video sequences 15 fps, 24 kbps show that the proposed techniques can complement the existing speedoriented ones to achieve lower energy/power consumption up to 13% relative to all ARM C++ optimization levels despite the 16KB Instruction and 16-KB data caches of ARM 920T core. © 2005 IEEE.
Some of the metrics are blocked by your
consent settings
Parallel hybrid dual pivot sorting algorithm
(2017-11-03)
Taotiamton, Surapong
;
Kittitornkun, Surin
Sorting is one of the common problems in Computer Science and data analytics. This paper presents empirical results of parallel Hybrid Dual Pivot Sort (HDPSort) for multicore/manycore CPU systems. HDPSort makes use of both classic Lomuto and Hoare partioning algorithms with two pivot values in parallel. It is developed in C++ with OpenMP 3.0 or better. HDPSort is benchmarked with the sequential STLSort in terms of run time, instruction count and branch load. The Speedups of HDPSort are up to 3.02× and 2.79× faster than the STLSort on 8-core AMD FX-8320 and 4-core Intel i7-2600 Linux systems, respectively. An indepth analysis shows that HDPSort gains the Speedup by 300% over STLSort at the expense of 1%-4% of branch mispredictions.
Some of the metrics are blocked by your
consent settings
Low energy optimization for MPEG-4 video encoder on ARM-based mobile phones
(2006-11-02)
Pakdeepaiboonpol, P.
;
Kittitornkun, S.
Most compiler optimization techniques concern most about speed. In this paper, we present two high-level power/energy optimization methods for ARM-based battery-powered embedded multimedia systems, e.g. mobile phones, pocket PCs, personal multimedia systems, etc. The experiments using MPEG-4 simple profile level 0 (SP@LO) video encoder on ARM920T with two QCIF video sequences 15 fps, 24 kbps show that the proposed techniques can complement the existing speed-oriented ones to achieve lower energy/power consumption up to 5.7% relative to all ARM C++ optimization levels despite the 16-KB instruction and 16-KB data caches of ARM 920T core. © 2006 IEEE.

Kittitornkun, Surin

Filters

Settings

Sort By

Results per page