Granidt: Towards Gigabit Rate Network Intrusion Detection Technology

Gokhale, Maya; DuBois, D. F.; DuBois, Andrew; Boorman, Mike; Poole, Steve; Hogsett, Vic

doi:10.1007/3-540-46117-5_43

Cited by 86 publications

(60 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since these designs hard-code the patterns into the FPGA fabric, runtime updates are forbidden without complete FPGA reconfiguration. Content-addressable memories (CAMs) that support updates were proposed by Gokhale et al [10]. Sourdis et al [11] applied pre-decoding with CAM-based pattern matching to reduce the consumed area.…”

Section: Related Workmentioning

confidence: 99%

Efficient hardware support for pattern matching in network intrusion detection

Guinde

Ziavras

2010

Computers & Security

View full text Add to dashboard Cite

Abstract-Deep packet inspection forms the backbone of any Network Intrusion Detection (NID) system. It involves matching known malicious patterns against the incoming traffic payload. Pattern matching in software is prohibitively slow in comparison to current network speeds. Due to the high complexity of matching, only FPGA (Field-Programmable Gate Array) or ASIC (Application-Specific Integrated Circuit) platforms can provide efficient solutions. FPGAs facilitate target architecture specialization due to their field programmability. Costly ASIC designs, on the other hand, are normally resilient to pattern updates. Our FPGA-based solution performs high-speed pattern matching while permitting pattern updates without resource reconfiguration. To its advantage, our solution can be adopted by software and ASIC realizations, however at the expense of much lower performance and higher price, respectively. Our solution permits the NID system to function while pattern updates occur. An off-line optimization method first finds common subpatterns across all the patterns in the SNORT database of signatures [14]. A novel technique then compresses each pattern into a bit vector, where each bit represents such a sub-pattern. This approach reduces drastically the required on-chip storage as well as the complexity of pattern matching. The bit vectors for newly discovered patterns can be generated easily using a simple high-level language program before storing them into the on-chip RAM. Compared to earlier approaches, not only is our strategy very efficient while supporting runtime updates but it also results in impressive area savings; it utilizes just 0.052 logic cells for processing and 17.77 bits for storage per character in the current SNORT database of 6455 patterns. Also, the total number of logic cells for processing the traffic payload does not change with pattern updates.

show abstract

Section: Related Workmentioning

confidence: 99%

Efficient hardware support for pattern matching in network intrusion detection

Guinde

Ziavras

2010

Computers & Security

View full text Add to dashboard Cite

show abstract

“…Since these designs hard-code the patterns into the FPGA, runtime updates are forbidden without complete FPGA reconfiguration. Content-addressable memories (CAMs) that support updates were proposed by Gokhale et al [12]. Sourdis et al [14] applied pre-decoding with CAM-based pattern matching to reduce the consumed area.…”

Section: Related Workmentioning

confidence: 99%

Novel FPGA-Based Signature Matching for Deep Packet Inspection

Guinde

Ziavras

2010

Information Security Theory and Practices. Security and Privacy of Pervasive Systems and Smart Devices

View full text Add to dashboard Cite

Abstract. Deep packet inspection forms the backbone of any Network Intrusion Detection (NID) system. It involves matching known malicious patterns against the incoming traffic payload. Pattern matching in software is prohibitively slow in comparison to current network speeds. Thus, only FPGA (Field-Programmable Gate Array) or ASIC (ApplicationSpecific Integrated Circuit) solutions could be efficient for this problem. Our FPGA-based solution performs high-speed matching while permitting pattern updates without resource reconfiguration. An off-line optimization method first finds sub-pattern similarities across all the patterns in the SNORT database of signatures [17]. A novel technique then compresses each pattern into a bit vector where each bit represents such a sub-pattern. Our approach reduces drastically the required on-chip storage as well as the complexity of matching, utilizing just 0.05 logic cells for processing and 17.74 bits for storage per character in the current SNORT database of 6456 patterns.

show abstract

“…Such improvement allowed the decoder design to fit into a single FPGA with performance of several gigabits per second Gokale et al of Los Alamos National Laboratory implemented a fast re-programmable pattern search system using content addressable memories (CAM) [11]. Although such system does not require reconfiguration of FPGA, the low performance of CAM limits the usefulness as well as the number of mappable rules.…”

Section: Related Workmentioning

confidence: 99%

“…However, other than the CAM implementation [11] and the bloom filter design [12], the FPGA design compilation and reconfiguration time can be in the order of minutes to days. Such delay in reconfiguration may not acceptable as new worms are released to the network in higher frequency.…”

Section: Related Workmentioning

confidence: 99%

A pattern matching coprocessor for network security

Cho¹,

Mangione-Smith²

2005

Proceedings of the 42nd Annual Conference on Design Automation - DAC '05

View full text Add to dashboard Cite

It has been estimated that computer network worms and virus caused the loss of over $55B in 2003. Network security system use techniques such as deep packet inspection to detect the harmful packets. While software intrusion detection system running on general purpose processors can be updated in response to new attacks. They lack the processing power to monitor gigabit networks. We present a high performance pattern matching co-processor architecture that can be used to monitor and identify a large number of intrusion signature. The design consists of a bank of pattern matchers that are used to implement a highly concurrent filter. The pattern matchers can be programmed to match multiple patterns of various lengths, and are able to leverage the existing databases of threat signatures. We have been able to program the filters to match all the payload patterns defined in the widely used Snort network intrusion detection system at a rate above 7 Gbps, with memory space left to accommodate threat signatures that become available in the future.

show abstract

Granidt: Towards Gigabit Rate Network Intrusion Detection Technology

Cited by 86 publications

References 2 publications

Efficient hardware support for pattern matching in network intrusion detection

Efficient hardware support for pattern matching in network intrusion detection

Novel FPGA-Based Signature Matching for Deep Packet Inspection

A pattern matching coprocessor for network security

Contact Info

Product

Resources

About