A High-Performance Golang-Based Network Intrusion Detection System

Sammanfattning

Distributed Denial of Service (DDoS) attacks remain a serious threat to transportnetworks, with recent attack volumes exceeding 30 Tbps, and the telecommunications industry being the main target. However, recent work has yet to study theimpact of different architectures to host monitoring solutions, nor to assess the use ofrecent algorithms to improve attack detection. This thesis presents a Golang-basedNetwork Intrusion Detection System (NIDS) for DDoS detection in transport network environments, developed in collaboration with Ericsson’s Radio and TransportEngineering division.The work builds on a baseline that utilised a statistical model and improves it in twodirections. First, it improves detection effectiveness by utilising an Isolation Forestmodel that is trained on a wider set of flow features. These features are extracted byGoFlowMeter, an open source Go implementation of CICFlowMeter that we publishas part of this thesis. Second, it studies how the choice of software architectureaffects the performance of the NIDS by comparing a monolithic deployment, a Kafkabased microservice deployment, and a gRPC-based microservice deployment. Thesystem is evaluated on a Raspberry Pi 5 testbed using the CIC-DDoS2019 dataset,which is replayed as real network traffic through a separate sequential replayer.Extended Berkeley Packet Filter (eBPF) and Express Data Path (XDP) were alsoutilised to allow the NIDS to be able to process real traffic.The results show that detection quality is governed mainly by the choice of detectorrather than by the transport layer. The transport is not entirely neutral, however:the monolithic and gRPC variants reach almost the same accuracy, while the asynchronous Kafka pipeline trails them by roughly nine percentage points, an effectwe attribute to its decoupled, online-updated delivery rather than to the detectoritself. Compared with the statistical baseline, the Isolation Forest model achieves ahigher recall and F1 score, which means that it can flag low-volume attack windowsthat the baseline misses. On the software side, the gRPC variant adds less than2 milliseconds of transport time per window, while the Kafka variant adds about27 milliseconds, which reflects the cost of the durability and decoupling that Kafkaoffers. The monolithic variant shows the smallest processing time degradation whenthe detector is switched to Isolation Forest, although this advantage may depend onthe volume-heavy nature of the dataset. Together, these findings give practitionersa clearer view of the trade-off between detection quality and architectural overheadwhen deploying a NIDS on resource-constrained hardware.