String alignment pre-detection using unique subsequences for FPGA-based network intrusion detection

Serrano, José Manuel Bande; Palancar, José Hernández

doi:10.1016/j.comcom.2011.12.009

Cited by 10 publications

(3 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The present work is based on the partitioning methodology presented in [9] and then extended in [10]. Firstly, the initial signature set is partitioned into several sets denoted as u-sets.…”

Section: Partitioning Methodsmentioning

confidence: 99%

“…The first step in the construction of our architecture is to partition the signature set according to [9] and [10]. By using these methods, we guarantee only one possible signature match per clock cycle, for a u-set.…”

Section: Partitioning Methodsmentioning

confidence: 99%

“…In [11], they propose MIN-MAX algorithm for solving ambiguity and overlapped matching for Character Classes with Constraint Repetitions based Regular Expressions. A previous work was presented in [9] where the use of unique subsequences is introduced for reducing the hardware replication. In [8], a binary search tree state-of-the-art architecture is proposed, achieving the lowest memory cost per character but with a limited throughput.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

High Throughput Signature Based Platform for Network Intrusion Detection

Serrano

Palancar

Cumplido

2013

Progress in Pattern Recognition, Image Analysis, Computer Vision, and Applications

Self Cite

View full text Add to dashboard Cite

In this work we propose the intensive use of embedded memory blocks and logic blocks of the FPGA device for signature matching. In our approach we arrange signatures in memory arrays (MA) of embedded memory blocks, so that every signature is matched in one clock cycle. The matching logic is shared among all the signatures in one MA. In addition, we propose a character recodification method that allows memory bits savings, leading to a low byte/character cost. For fast memory addressing we employ the unique substring detection, in doing so we process four bytes per clock cycle while hardware replication is significantly reduced.

show abstract

Section: Partitioning Methodsmentioning

confidence: 99%

Section: Partitioning Methodsmentioning

confidence: 99%