Tools for Analyzing Signature-Based Hardware Solutions for Cyber Security Systems

Abstract

When creating signature-based cybersecurity systems for network intrusion detection (NIDS), spam filtering, protection against viruses, worms, etc., developers have to use hardware devices such as field programmable gate arrays (FPGA), since software solutions can no longer support the necessary speeds. There are many different approaches to build hardware circuits for pattern matching (where patterns are the parts of signatures). Choosing the optimal technical solution for certain conditions is not a trivial task. Developers of such hardware tend to act intuitively, heuristically. In this article, we provide tools to help them intelligently build cybersecurity systems using FPGAs. For the qualitative analysis of FPGA-based matching schemes, the classification of efficiency criteria and related indicators is considered. This classification was compiled by studying a large number of practical developments of FPGA-based cybersecurity systems, primarily NIDS. A method of rapid calculating numerical characteristics of the FPGA-based signature system components is proposed as a quantitative assessment tool. This method based on the use of so-called estimation functions allows avoiding the time-consuming execution of the digital circuit synthesis procedure. A number of experiments were carried out with the most promising matching schemes, allowing evaluating the above-mentioned tools. The rapid quantification method allows developers of hardware-accelerated cybersecurity systems to even apply it at each iteration within the optimization procedure cycle.

Detection of DDoS attacks in SDN with Siberian Tiger Optimization algorithm and deep learning

“…It serves as a meta-heuristic method designed for solving optimization problems. Figure 6 provides an illustration of a Siberian tiger [17].…”

“…The STO algorithm is employed to optimize the 1D CNN parameters. Equations ( 16), (17), and ( 18) are utilized to model the 1D component of CNN [53]. In these equations, x represents a one-dimensional input with n components.…”

“…IDS relying on blacklists face limitations in detecting zero-day attacks, and concurrently, they necessitate extensive memory and search time. [17]. Heuristic methods try to detect anomalies based on rules and regulations.…”