Implementing high-speed string matching hardware for network intrusion detection systems

Proceedings of the 2008 International Conference on Parallel and Distributed Processing Techniques and Applications, PDPTA 2008

Volumn , Issue , 2008, Pages 157-163

  Mahajan, Atul ^a   Soewito, Benfano ^a   Parsi, Sai K ^a   Weng, Ning ^a   Wang, Haibo ^a  

^a Southern Illinois University Carbondale   (United States)

Author keywords

And; FPGA based Design; Intrusion Detection System; Network Systems; Parallel Systems; Performance Evaluation

Indexed keywords

AND; FPGA-BASED DESIGN; INTRUSION DETECTION SYSTEM; NETWORK SYSTEMS; PARALLEL SYSTEMS; PERFORMANCE EVALUATION;

COMPUTER CRIME; DESIGN; DISTRIBUTED PARAMETER NETWORKS; FIELD PROGRAMMABLE GATE ARRAYS (FPGA); INTERNET; PARALLEL PROCESSING SYSTEMS;

INTRUSION DETECTION;

EID: 62749141308     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (18)

1. M. Aldwairi, T. Conte, and P. Franzon. Configurable string matching hardware for speeding up intrusion detection. SIGARCH Comput. Archit. News, 33(1):99-107, 2005.
2. M. Attig and J. Lockwood. Sift: Snort intrusion filter for tcp. In Proceedings of 13th Symposium on High Performance Interconnects, pages 121-127, 2005.
3. Z. K. Baker and V. K. Prasanna. Time and area efficient pattern matching on fpgas. In FPGA '04: Proceedings of the 2004 ACM/SIGDA 12th international symposium on Field programmable gate arrays, pages 223-232, New York, NY, USA, 2004. ACM Press.
4. B. Brodie, R. Cytron, and D. Taylor. A scalable architecture for high-throughput regular-expression pattern matching. In Proc. 33rd International Symposium on Computer Architecture, 2006.
5. L. Bu and J. A. Chandy. FPGA based network intrusion detection using content addressable memories. In FCCM '04: Proceedings of the 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines, pages 316-317, Washington, DC, USA, 2004. IEEE Computer Society.
6. D. Denning. An intrusion-detection model. IEEE Transactions on Software Engineering, 13(2):222-232, Feb. 1987.
7. S. Dharmapurikar, P. Krishnamurthy, T. Sproull, and J. Lockwood. Deep packet inspection using parallel bloom filters. IEEE Micro, 24(1):52-61, Jan. 2004.
8. S. Dharmapurikar, P. Krishnamurthy, T. S. Sproull, and J. W. Lockwood. Deep packet inspection using parallel Bloom filters. IEEE Micro, 24(1):52-61, Jan. 2004.
9. R.-T. Liu, N.-F. Huang, C.-H. Chen, and C.-N. Kao. A fast string-matching algorithm for network processor-based intrusion detection system. Trans. on Embedded Computing Sys., 3(3):614-633, 2004.
10. P. Piyachon and Y. Luo. Efficient memory utilization on network processors for deep packet inspection. In ANCS '06: Proceedings of the 2006 ACM/IEEE symposium on Architecture for networking and communications systems, pages 71-80, New York, NY, USA, 2006. ACM Press.
11. M. Roesch. Snort - lightweight intrusion detection for networks. In Proc. of the 13th Systems Administration Conference, 1999.
12. Snort, Inc. The Open Source Network Instrusion Detection System, 2004. http://www.snort.org.
13. H. Song and J. W. Lockwood. Efficient packet classification for network intrusion detection using fpga. In FPGA '05: Proceedings of the 2005 ACM/SIGDA 13th international symposium on Field-programmable gate arrays, pages 238-245, New York, NY, USA, 2005. ACM Press.
14. Y. Sugawara, M. Inaba, and K. Hiraki. Over 10gbps string matching mechanism for multi-stream packet scanning systems. In Lecture Notes in Computer Science, volume 3203, pages 484-493. Springer-Verlag, 2004.
15. L. Tan and T. Sherwood. Architectures for bit-split string scanning in intrusion detection. IEEE Micro, (1):2-9, 2006.
16. G. Varghese. Network Algorithmics: An Interdisciplinary Approach to Designing Fast Networked Devices. Morgan Kaufmann, 1st edition, 2005.
17. Xilinx, Inc. Virtex-IV Pro and Virtex-IV Pro X Platform FPGAs: Complete Data Sheet, 2004. http://www.xilinx.com.
18. F. Yu, R. H. Katz, and T. V. Lakshman. Gigabit rate packet pattern-matching using tcam. In ICNP '04: Proceedings of the Network Protocols, 12th IEEE International Conference on (ICNP'04), pages 174-183, Washington, DC, USA, 2004. IEEE Computer Society.