Novel FPGA-based signature matching for deep packet inspection

Document Type

Conference Proceeding

Publication Date

12-24-2010

Abstract

Deep packet inspection forms the backbone of any Network Intrusion Detection (NID) system. It involves matching known malicious patterns against the incoming traffic payload. Pattern matching in software is prohibitively slow in comparison to current network speeds. Thus, only FPGA (Field-Programmable Gate Array) or ASIC (Application- Specific Integrated Circuit) solutions could be efficient for this problem. Our FPGA-based solution performs high-speed matching while permitting pattern updates without resource reconfiguration. An off-line optimization method first finds sub-pattern similarities across all the patterns in the SNORT database of signatures [17]. A novel technique then compresses each pattern into a bit vector where each bit represents such a sub-pattern. Our approach reduces drastically the required on-chip storage as well as the complexity of matching, utilizing just 0.05 logic cells for processing and 17.74 bits for storage per character in the current SNORT database of 6456 patterns. © IFIP International Federation for Information Processing 2010.

Identifier

78650366490 (Scopus)

ISBN

[3642123678, 9783642123672]

Publication Title

Lecture Notes in Computer Science Including Subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics

External Full Text Location

https://doi.org/10.1007/978-3-642-12368-9_21

e-ISSN

16113349

ISSN

03029743

First Page

261

Last Page

276

Volume

6033 LNCS

Grant

0924279

Fund Ref

Directorate for Computer and Information Science and Engineering

This document is currently not available here.

Share

COinS