Scalable multigigabit pattern matching for packet inspection

IEEE Transactions on Very Large Scale Integration (VLSI) Systems

Volumn 16, Issue 2, 2008, Pages 156-166

  Sourdis, Ioannis ^a,b   Pnevmatikatos, Dionisios N ^a,c,d   Vassiliadis, Stamatis ^a,b  

^a IEEE

^b DELFT UNIVERSITY OF TECHNOLOGY   (Netherlands)

^c TECHNICAL UNIVERSITY OF CRETE   (Greece)

^d INSTITUTE OF COMPUTER SCIENCE   (Greece)

Author keywords

Packet inspection; Pattern matching; Perfect hashing; Reconfigurable computing

Indexed keywords

COMPUTER HARDWARE; FIELD PROGRAMMABLE GATE ARRAYS (FPGA); INTRUSION DETECTION; PACKET NETWORKS; SYSTEMS ANALYSIS;

PERFECT HASHING; RECONFIGURABLE COMPUTING;

PATTERN MATCHING;

EID: 38349152484     PISSN: 10638210     EISSN: None     Source Type: Journal    
DOI: 10.1109/TVLSI.2007.912036     Document Type: Article

References (32)

1. B. L. Hutchings, R. Franklin, and D. Carver, "Assisting network intrusion detection with configurable hardware," in Proc. IEEE Symp. Field-Program. Custom Comput. Mach., 2002, pp. 111-120.
2. Y. H. Cho, S. Navab, and W. Mangione-Smith, "Specialized hardware for deep network packet filtering," in Proc. 12th Int. Conf. Field Program. Logic Appl., 2002, pp. 452-461.
3. M. Gokhale, D. Dubois, A. Dubois, M. Boorman, S. Poole, and V. Hogsett, "Granidt: Towards gigabit rate network intrusion detection technology," in Proc. Int. Conf. Field Program. Logic Appl., 2002, pp. 404-413.
4. I. Sourdis and D. Pnevmatikatos, "Fast, large-scale string match for a 10 Gbps FPGA-based network intrusion detection system," in Proc. Int. Conf. Field Program. Logic Appl., 2003, pp. 880-889.
5. Z. K. Baker and V. K. Prasanna, "A methodology for synthesis of efficient intrusion detection systems on FPGAs," in Proc. IEEE Symp. Field-Program. Custom Comput. Mach., 2004, pp. 135-144.
6. C. R. Clark and D. E. Schimmel, "Scalable parallel pattern-matching on high-speed networks," in Proc. IEEE Symp. Field-Program. Custom Comput. Mach., 2004, pp. 249-257.
7. Y. H. Cho and W. H. Mangione-Smith, "Deep packet filter with dedicated logic and read only memories," in Proc. IEEE Symp. Field-Program. Custom Comput. Mach., 2004, pp. 125-134.
8. I. Sourdis and D. Pnevmatikatos, "Pre-decoded CAMs for efficient and high-speed NIDS pattern matching," in Proc. IEEE Symp. Field-Program, Custom Comput. Mach., 2004, pp. 258-267.
9. Z. K. Baker and V. K. Prasanna, "Automatic synthesis of efficien intrusion detection systems on FPGAs," in Proc. 14th Int. Conf. Field Program, Logic Appl., 2004, pp. 311-321.
10. M. Attig, S. Dharmapurikar, and J. Lockwood, "Implementation results of bloom filters for string matching," in Proc. IEEE Symp. Field-Program. Custom Comput. Mach., 2004, pp. 322-323.
11. Y. H. Cho and W. H. Mangione-Smith, "Programmable hardware for deep packet filtering on a large signature set," in Proc. Conf. Interaction Between Arch., Circuits, Compilers(P = ac2), 2004.
12. L. Tan and T. Sherwood, "A high throughput string matching architecture for intrusion detection and prevention," in Proc. 32nd Int. Symp. Comput. Arch. (ISCA), 2005, pp. 112-122.
13. P. Krishnamurthy, J. Buhler, R. D. Chamberlain, M. A. Franklin, K. Gyang, and J. Lancaster, "Biosequence similarity search on the mercury system," in Proc. 15th IEEE Int. Conf. Appl.-Specific Syst., Arch., Processors (ASAP), 2004, pp. 365-375.
14. E. Sotiriadis, C. Kozanitis, and A. Dollas, "FPGA based architecture for DNA sequence comparison and database search," presented at the 13th Reconfigurable Arch. Workshop (RAW), Rodos, Greece, 2006.
15. SNORT, "SNORT official website," 2007. [Online], Available: http://www.snort.org
16. M. Fisk and G. Varghese, "An analysis of fast string matching applied to content-based forwarding and intrusion detection," Univ. California, San Diego, Tech. Rep. CS2001-0670, 2002.
17. S. Antonatos, K. G. Anagnostakis, E. P. Markatos, and M. Polychronakis, "Performance analysis of content matching intrusion detection systems," in Proc. Int. Symp. Appl. Internet, 2004, pp. 208-218.
18. R. Sidhu and V. K. Prasanna, "Fast regular expression matching using FPGAs," in Proc. 9th IEEE Symp. Field-Program. Custom Comput. Mach. (FCCM), 2001, pp. 227-238.
19. I. Sourdis, D. Pnevmatikatos, S. Wong, and S. Vassiliadis, "A reconfigurable perfect-hashing scheme for packet inspection," in Proc. 15th Int. Conf. Field Program. Logic Appl., 2005, pp. 644-647.
20. Z. K. Baker and V. K. Prasanna, "Automatic synthesis of efficient intrusion detection systems on FPGAs," IEEE Trans. Dependable Sec. Comput., vol. 3, no. 4, pp. 289-300, Oct. 2006.
21. J. Singaraju, L. Bu, and J. A. Chandy, "A signature match processor architecture for network intrusion detection," in Proc. IEEE Symp. Field-Program. Custom Comput. Mach., 2005, pp. 235-242.
22. J. Moscola, J. Lockwood, R. P. Loui, and M. Pachos, "Implementation of a content-scanning module for an internet firewall," in Proc. IEEE Symp. Field-Program. Custom Comput. Mach., 2003, pp. 31-38.
23. S. Dharmapurikar, P. Krishnamurthy, T. S. Sproull, and J. W. Lockwood, "Deep packet inspection using parallel Bloom, filters," IEEE Micro, vol. 24, no. 1, pp. 52-61, Jan. 2004.
24. G. Papadopoulos and D. Pnevmatikatos, "Hashing + Memory = Low Cost, exact pattern matching," in Proc. Int. Conf. Field Program. Logic Appl., 2005, pp. 39-44.
25. S. Yusuf and W. Luk, "Bitwise optimized CAM for network intrusion detection systems," in Proc. Int. Conf. Field Program. Logic Appl., 2005, pp. 444-449.
26. H.-J. Jung, Z. K. Baker, and V. K. Prasanna, "Performance of FPGA implementation of bit-split architecture for intrusion detection systems," presented at the Reconfigurable Arch. Workshop IPDPS (RAW), Rodos, Greece, 2006.
27. Xilinx, San Jose, CA, "VirtexE, Viitex2, Virtex2Pro, and Spartan3 datasheets," 2006. [Online]. Available: http://www.xilinx.com
28. F. J. Burkowski, "A hardware hashing scheme in the design of a multiterm string comparator," IEEE Trans. Comput., vol. 31, no. 9, pp. 825-834, Sep. 1982.
29. R. C. Merkle, "Protocols for public key cryptosystems," in Proc. IEEE Symp. Security Privacy, 1980, pp. 122-134.
30. N. Song and M. A. Perkowski, "Minimization of exclusive sum-of-products expressions for multiple-valued input, incompletely specified functions," IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst., vol. 15, no. 4, pp. 385-395, Apr. 1996.
31. T. Kozlowski, E. L. Dagless, and J. Saul, "An enhanced algorithm for the minimization, of exclusive-OR sum-of-products for incompletely specified functions," in Proc. Int. Conf. Comput. Des., 1995, pp. 244-249.
32. T. Sproull, G. Brebner, and C. Neely, "Mutable codesign for embedded protocol processing," in Proc. Int. Conf. Field Program. Logic Appl., 2005, pp. 51-56.