Efficient hardware support for pattern matching in network intrusion detection

Abstract

Abstract-Deep packet inspection forms the backbone of any Network Intrusion Detection (NID) system. It involves matching known malicious patterns against the incoming traffic payload. Pattern matching in software is prohibitively slow in comparison to current network speeds. Due to the high complexity of matching, only FPGA (Field-Programmable Gate Array) or ASIC (Application-Specific Integrated Circuit) platforms can provide efficient solutions. FPGAs facilitate target architecture specialization due to their field programmability. Costly ASIC designs, on the other hand, are normally resilient to pattern updates. Our FPGA-based solution performs high-speed pattern matching while permitting pattern updates without resource reconfiguration. To its advantage, our solution can be adopted by software and ASIC realizations, however at the expense of much lower performance and higher price, respectively. Our solution permits the NID system to function while pattern updates occur. An off-line optimization method first finds common subpatterns across all the patterns in the SNORT database of signatures [14]. A novel technique then compresses each pattern into a bit vector, where each bit represents such a sub-pattern. This approach reduces drastically the required on-chip storage as well as the complexity of pattern matching. The bit vectors for newly discovered patterns can be generated easily using a simple high-level language program before storing them into the on-chip RAM. Compared to earlier approaches, not only is our strategy very efficient while supporting runtime updates but it also results in impressive area savings; it utilizes just 0.052 logic cells for processing and 17.77 bits for storage per character in the current SNORT database of 6455 patterns. Also, the total number of logic cells for processing the traffic payload does not change with pattern updates.

Performance Evaluation of an Intrusion Detection System

“…An off-line optimization method first finds common sub-patterns across all the patterns in the SNORT database of signatures. For that, we based on work [12,13] to make implement the part pattern-matching. To manage the pattern-matching, we have developed an FPGA design by VHDL (VHSIC hardware description language; VHSIC, very-high-speed integrated circuits).…”

Compact and Fast Machine Learning Accelerator for IoT Devices

“…A custom-tailored hardware such as embedded FPGA can achieve better energyefficiency with higher detection speed. Previous works on hardware based intrusion detection are mainly based on machine learning pre-trained models [38,41]. However, it suffers from two limitations.…”

High Throughput Signature Based Platform for Network Intrusion Detection

“…In doing so a reduction of 24% in the cost is achieved. Guinde and Ziavras [7] proposed a compression method for the string set where the required memory for storing the set is significantly reduced. In [11], they propose MIN-MAX algorithm for solving ambiguity and overlapped matching for Character Classes with Constraint Repetitions based Regular Expressions.…”