Digenis

Introduction

Digenis (Figure 1) is composed of a network processor board (IXP1200) and a number of sensors (PCs) connected with the network processor. The network processor is the entry and exit point of the traffic that runs through the system. The basic task of the network processor is to evenly distribute the traffic across sensors and to transmit the friendly packets back to their destination. Sensors are responsible for the heavy task of inspecting the traffic for intrusion attempts. They maintain the required information for recognizing all the malicious traffic and deciding whether to forward or drop the packet.

Figure 1: Digenis Architecture

For every input packet, the network processor computes which of the sensors will be responsible to analyze this packet. Then it forwards the packet to a sensor for inspection. The sensor searches for known attack patterns contained in the packet. If a pattern is found, then the packet is blocked, otherwise the packet is forwarded back to the network processor. The network processor receives the analyzed packet and transmits it to its destination.