A memory efficient FPGA-based pattern matching engine for stateful NIDS

Hieu, Tran Trung; Tran, Ngoc Thinh

doi:10.1109/icufn.2013.6614821

Cited by 10 publications

(4 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Software-based approaches struggle to keep up with attacks in high-speed networks [1,2]. Hardware solutions for NIDS and anomaly detection present an advantage at keeping up with higher and higher network speeds [3,4,5,6]. Overall, the goal is to execute complete packet analysis without delay in high-speed/high-load environments.…”

Section: Network Intrusion Detectionmentioning

confidence: 97%

Neuromorphic computing applications for network intrusion detection systems

Garcia

Pino

2014

SPIE Proceedings

View full text Add to dashboard Cite

What is presented here is a sequence of evolving concepts for network intrusion detection. These concepts start with neuromorphic structures for XOR-based signature matching and conclude with computationally based network intrusion detection system with an autonomous structuring algorithm. There is evidence that neuromorphic computation for network intrusion detection is fractal in nature under certain conditions. Specifically, the neural structure can take fractal form when simple neural structuring is autonomous. A neural structure is fractal by definition when its fractal dimension exceeds the synaptic matrix dimension. The authors introduce the use of fractal dimension of the neuromorphic structure as a factor in the autonomous restructuring feedback loop.

show abstract

Section: Network Intrusion Detectionmentioning

confidence: 97%

Neuromorphic computing applications for network intrusion detection systems

Garcia

Pino

2014

SPIE Proceedings

View full text Add to dashboard Cite

show abstract

“…Although FPGA NFA schemes can achieve high matching performance for complex rule-sets, rule-set updates in FPGA NFA schemes are extremely tricky because FPGA circuit synthesis is required to map NFA state to FPGA circuits. Some FPGA REM schemes [9], [29]- [31] also employ DFA to perform regex matching. The biggest advantage of employing DFA instead of NFA in FPGA is that the ruleset update for FPGA DFA schemes only needs to rewrite the FPGA memories, which is a fast procedure.…”

Section: A Software Rem Schemesmentioning

confidence: 99%

FPGA-CPU Architecture Accelerated Regular Expression Matching With Fast Preprocessing

Zhong

Chen

Han

2022

The Computer Journal

View full text Add to dashboard Cite

Regular Expression Matching (REM) is the core of Deep Packet Inspection (DPI), which is important for various network security applications. The burgeoning Software Defined Network and Network Function Virtualization technologies make the network evolve more dynamic, which brings serious challenges for DPI engines to achieve high matching performance with fast rule-set update capability. To meet these challenges, this paper proposes a heterogeneous Field Programmable Gate Array (FPGA)-Central Processing Unit (CPU) architecture to accelerate Deterministic Finite Automaton (DFA)-based REM with high preprocessing performance. Firstly, a novel regex decomposition technique is proposed to solve the DFA state explosion problem, which splits each regex into one prefix and several postfixes. Secondly, heterogeneous architecture is presented to collaboratively handle regex matching, in which prefixes are matched in parallel in an FPGA and postfixes are matched in a CPU. To further improve the matching performance, several well-designed DFA compression techniques and regex decomposition optimizations are proposed. Our design has been implemented in a DPI prototype employing a medium-end FPGA. Extensive experiments are conducted to evaluate the performance. Results reveal that our proposed architecture achieves 6.33 Gbps matching throughput on the Snort rule-set (v3.0), which is close to state-of-the-art FPGA NFA-based schemes. However, the rule-set preprocessing time is significantly reduced to <7 minutes, compared with up to several hours of FPGA NFA-based countermeasures.

show abstract

“…Nondeterministic Finite Automaton (NFA) is a popular computation model to perform complex pattern matching described by specification languages like regular expressions. NFA has shown promising applications in network security [16], [20], [31], [39], data mining [28], [36], natural language processing [25], bioinformatics [7], [23], finance [1], machine learning [8], and runtime verification of cyber-physical and embedded systems [3]. These applications demand high-speed processing of large and complex NFAs on real-time data collected from sensors, networks, and various system traces.…”

Section: Introductionmentioning

confidence: 99%

CAMA: Energy and Memory Efficient Automata Processing in Content-Addressable Memories

Huang¹,

Chen²,

Li³

et al. 2021

Preprint

View full text Add to dashboard Cite

Accelerating finite automata processing is critical for advancing real-time analytic in pattern matching, data mining, bioinformatics, intrusion detection, and machine learning. Recent in-memory automata accelerators leveraging SRAMs and DRAMs have shown exciting improvements over conventional digital designs. However, the bit-vector representation of state transitions used by all state-of-the-art (SOTA) designs is only optimal in processing worst-case completely random patterns, while a significant amount of memory and energy is wasted in running most real-world benchmarks.We present CAMA, a Content-Addressable Memory (CAM) enabled Automata accelerator for processing homogeneous nondeterministic finite automata (NFA). A radically different state representation scheme, along with co-designed novel circuits and data encoding schemes, greatly reduces energy, memory, and chip area for most realistic NFAs. CAMA is holistically optimized with the following major contributions: (1) a 16×256 8-transistor (8T) CAM array for state matching, replacing the 256×256 6T SRAM array or two 16×256 6T SRAM banks in state-of-theart (SOTA) designs; (2) a novel encoding scheme that enables content searching within 8T SRAMs and adapts to different applications; (3) a reconfigurable and scalable architecture that improves efficiency on all tested benchmarks, without losing support for any NFA that's compatible with SOTA designs; (4) an optimization framework that automates the choice of encoding schemes and maps a given NFA to the proposed hardware.Two versions of CAMA, one optimized for energy (CAMA-E) and the other for throughput (CAMA-T), are comprehensively evaluated in a 28nm CMOS process, and across 21 real-world and synthetic benchmarks. CAMA-E achieves 2.1×, 2.8×, and 2.04× lower energy than CA, 2-stride Impala, and eAP. CAMA-T shows 2.68×, 3.87× and 2.62× higher average compute density than 2-stride Impala, CA, and eAP. Both versions reduce the chip area required for the largest tested benchmark by 2.48× over CA, 1.91× over 2-stride Impala, and 1.78× over eAP.

show abstract

A memory efficient FPGA-based pattern matching engine for stateful NIDS

Cited by 10 publications

References 9 publications

Neuromorphic computing applications for network intrusion detection systems

Neuromorphic computing applications for network intrusion detection systems

FPGA-CPU Architecture Accelerated Regular Expression Matching With Fast Preprocessing

CAMA: Energy and Memory Efficient Automata Processing in Content-Addressable Memories

Contact Info

Product

Resources

About