Hardware-based multi-match packet classification in NIDS: an overview and novel extensions for improving the energy efficiency of TCAM-based classifiers

Srinivasavarma, Vegesna S. M.; Pydi, Shanmukha Rao; Sk, Noor Mahammad

doi:10.1007/s11227-022-04377-8

Cited by 3 publications

(1 citation statement)

References 47 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although the session feature is most commonly used, research using packet data as a feature is also underway to solve the shortcomings of the session feature [24] [25]. To directly use packet data as features, features are simply created by applying one-hot encoding to each byte value of the packet data [24].…”

Section: Previous Workmentioning

confidence: 99%

Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier

Kim

Pak

2022

IEEE Access

View full text Add to dashboard Cite

Early detection of network intrusions is a very important factor in network security. However, most studies of network intrusion detection systems utilize features for full sessions, making it difficult to detect intrusions before a session ends. To solve this problem, the proposed method uses packet data for features to determine if packets are malicious traffic. Such an approach inevitably increases the probability of falsely detecting normal packets as an intrusion or an intrusion as normal traffic for the initial session. As a solution, the proposed method learns the patterns of packets that are unhelpful in order to classify network intrusions and benign sessions. To this end, a new training dataset for Generative Adversarial Network (GAN) is created using misclassified data from an original training dataset by the LSTM-DNN model trained using the original one. The GAN trained with this dataset has ability to determine whether the currently received packet can be accurately classified in the LSTM-DNN. If the GAN determines that the packet cannot be classified correctly, the detection process is canceled and will be tried again when the next packet is received. Meticulously designed classification algorithm based on LSTM-DNN and validation model using GAN enable the proposed algorithm to accurately perform network intrusion detection in real time without session termination or delay time for collecting a certain number of packets. Various experiments confirm that the proposed method can detect intrusions very early (before the end of the session) while maintaining detection performance at a level similar to that of the existing methods.

show abstract

Section: Previous Workmentioning

confidence: 99%

Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier

Kim

Pak

2022

IEEE Access

View full text Add to dashboard Cite

show abstract

Energy efficient and high throughput prefix-based pattern matching technique on TCAMs for NIDS

Shaik,

Vegesna,

S.K.

2025

Integration

View full text Add to dashboard Cite

Deterministic Approach for Range-enhanced Reconfigurable Packet Classification Engine

2023

ACM Trans. Reconfigurable Technol. Syst.

View full text Add to dashboard Cite

Reconfigurable hardware is a promising technology for implementing firewalls, routing mechanisms, and new protocols for evolving high-performance network systems. This work presents a novel deterministic approach for a Range Enhanced Reconfigurable Packet Classification Engine (RERPEC) based on the number of rules on FPGAs. The proposed framework uses a RAM established Ternary Match to represent the prefix and the range prefix and efficient rule-reordering for priority selection to get both best-match and multi-match in the same architecture. The recommended framework exhibits 3.2 Mbits of LUT-RAM based TCAM to hold a maximum of 31.3 K of 104 − bit rules with 520 MPPS . LUT-RAM, along with BRAM, shows 4 Mbits of TCAM space to implement 38.5 K of 104 − bits rules to sustain a throughput of 400 MPPS on Virtex-7 FPGA. The complete architecture offers scalability, better resource utilization (minimum of 50% ), representation of inverse prefix with single entry, range expansion with a single rule, getting best and multi-match, and determination of the required number of FPGA resources for a particular dataset.

show abstract

Hardware-based multi-match packet classification in NIDS: an overview and novel extensions for improving the energy efficiency of TCAM-based classifiers

Cited by 3 publications

References 47 publications

Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier

Early Detection of Network Intrusions Using a GAN-Based One-Class Classifier

Energy efficient and high throughput prefix-based pattern matching technique on TCAMs for NIDS

Deterministic Approach for Range-enhanced Reconfigurable Packet Classification Engine

Contact Info

Product

Resources

About