FPGA-based intrusion detection system for 10 Gigabit Ethernet

IEICE Transactions on Information and Systems

Volumn E90-D, Issue 12, 2007, Pages 1923-1931

  Katashita, Toshihiro ^a   Yamaguchi, Yoshinori ^b   Maeda, Atusi ^b   Toda, Kenji ^a  

^a NATIONAL INSTITUTE OF ADVANCED INDUSTRIAL SCIENCE AND TECHNOLOGY AIST   (Japan)

^b UNIVERSITY OF TSUKUBA   (Japan)

Author keywords

10 Gigabit Ethernet; Exact string matching; FPGA; Intrusion detection system; Intrusion protection system

Indexed keywords

COMPUTER CRIME; DATA HANDLING; ELECTRIC EQUIPMENT PROTECTION; ETHERNET; FIELD PROGRAMMABLE GATE ARRAYS (FPGA); MERCURY (METAL); NETWORK SECURITY;

10-GIGABIT ETHERNET; HIGH THROUGHPUT; INTRUSION DETECTION SYSTEMS; INTRUSION PROTECTION SYSTEMS; MATCHING RULES; PACKET FILTERING; RESOURCE REQUIREMENTS; STRING MATCHING;

INTRUSION DETECTION;

EID: 68249135569     PISSN: 09168532     EISSN: 17451361     Source Type: Journal    
DOI: 10.1093/ietisy/e90-d.12.1923     Document Type: Article

References (17)

1. M. Roesch, "Snort - Lightweight intrusion detection for networks," 13th Systems Administration Conference, LISA '99, pp. 229-238, 1999.
2. R. Sidhu and V.K. Prasanna, "Fast regular expression matching using fpgas," Proc. IEEE FCCM 2001, pp. 227-238, 2001.
3. B.L. Hutchings and D.C. R. Franklin, "Assisting network intrusion detection with reconfigurable hardware," FCCM2002, pp. 111-120, 2002.
4. C.R. Clark and D.E. Schimmel, "Scalable pattern matching for high speed networks," FCCM2004, pp. 249-257, 2004.
5. T. Katashita, A. Maeda, K. Toda, and Y. Yamaguchi, "A method of generating highly efficient string matching circuit for intrusion detection," FPL 2006, pp. 799-802, 2006.
6. Z.K. Baker and V.K. Prasanna, "A methodology for synthesis of efficient intrusion detection systems on FPGAs," FCCM2004, pp. 135-144, 2004.
7. Y. Sugawara, M. Inaba, and K. Hiraki, "Over 10 Gbps string matching mechanism for multi-stream packet scanning systems," FPL 2004, pp. 225-234, 2004.
8. I. Sourdis and D. Pnevmatikatos, "Pre-decoded cams for efficient and high-speed nids pattern matching," FCCM2004, pp. 258-267, Napa, CA, 2004.
9. J. Singaraju, L. Bu, and J.A. Chandy, "A signature match processor architecture for network intrusion detection," FCCM2005, pp. 235-242, Napa, CA, 2005.
10. Z.K. Baker and V.K. Prasanna, "Time and area efficient pattern matching on fpgas," FPGA'04, pp. 223-232, 2004.
11. G. Papadopoulos and D. Pnevmatikatos, "Hashing + memory=low cost, exact pattern matching," Field Programmable Logic and Applications, 2005, pp. 39-44, 2005.
12. P. Katta, M. Nourani, and R. Panigrahy, "String matching engine using parallel hashing," PDCS 2006, pp. 478-483, 2006.
13. "Force 10 networks p-series, motel p 10 intrusion prevention system performance evaluation," Tech. Rep. 206126, THE TOLLY GROUP, 2006.
14. T. Katashita, A. Maeda, K. Toda, and Y. Yamaguchi, "Highly efficient string matching circuit for ids with FPGA," FCCM2006, pp. 285-286, 2006.
15. A.V. Aho and M.J. Corasick, "Efficient string matching: An aid to biblographic search," ACM Commun., vol. 18, no. 6, pp. 333-340, 1975.
16. Xilinx Inc, DS083, Virtex-II Pro and Virtex-II ProX Platform FP-GAs: Complete Data Sheet.
17. D.V. Schuehler and J. Lockwood, "Tcp-splitter: A tcp/ip flow monitor in reconfigurable hardware," High Performance Interconnects, 2002, pp. 127-131, 2002.