Architecture for a hardware based, TCP/IP content scanning system [intrusion detection system applications]

Proceedings - 11th Symposium on High Performance Interconnects, HOTI 2003

Volumn , Issue , 2003, Pages 89-94

  Schuehler, David V ^a   Moscola, James ^a   Lockwood, John ^a  

^a UNIVERSITY OF WASHINGTON   (United States)

Author keywords

Bandwidth; Hardware; Inspection; Internet; Intrusion detection; Monitoring; Protocols; Search engines; TCPIP; Telecommunication traffic

Indexed keywords

BANDWIDTH; COMPUTER CRIME; COMPUTER HARDWARE; HARDWARE; INSPECTION; INTERNET; INTERNET PROTOCOLS; MERCURY (METAL); MONITORING; NETWORK ARCHITECTURE; NETWORK PROTOCOLS; SCANNING; SEARCH ENGINES; TELECOMMUNICATION TRAFFIC; TRANSMISSION CONTROL PROTOCOL;

CONTENT SCANNING; GIGABITS PER SECOND; HARDWARE CIRCUITS; HARDWARE-ASSISTED; INTRUSION DETECTION SYSTEMS; PER-FLOW STATE; PROCESS DATA; TCPIP;

INTRUSION DETECTION;

EID: 84944060265     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CONECT.2003.1231483     Document Type: Conference Paper

References (14)

1. K. Bhargavan, S. Chandra, P. J. McCann, and C. A. Gunter. What packets may come: Automata for network monitoring. InProceedings of the 28th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, pages 206-219. ACM Press, 2001.
2. F. Braun, J. W. Lockwood, and M. Waldvogel. Layered Protocol Wrappers for Internet Packet Processing in Reconfigurable Hardware. In Proceedings of Symposium on High Performance Interconnects (HotI'01), pages 93-98, Stanford, CA, USA, Aug. 2001.
3. C. Fraleigh, C. Diot, B. Lyles, S. Moon, P. Owezarski, D. Papagiannaki, and F. Tobagi. Design and deployment of a passive monitoring infrastructure. Lecture Notes in Computer Science, vol 2170:page 556, 2001.
4. R. Franklin, D. Carver, and B. L. Hutchings. Assisting Network Intrusion Detection with Reconfigurable Hardware. In IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM), Napa, CA, USA, Apr. 2002.
5. M. Handley, V. Paxson, and C. Kreibich. Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics. In Proceedings of the 10th USENIX Security Symposium., Aug. 2001.
6. S. Jaiswal, G. Iannaccone, C. Diot, J. Kurose, and D. Towsley. Measurement and classification of out-of-sequence packets in a tier-1 IP backbone, 2002.
7. J. W. Lockwood. An Open Platform for Development of Network Processing Modules in Reprogrammable Hardware. In IEC DesignCon'01, pagesWB-19, Santa Clara, CA, Jan. 2001.
8. E. P. Markatos. Speeding up TCP / IP : Faster processors are not enough. Technical Report 297, 2001.
9. J. Moscola, J. Lockwood, R. P. Loui, and M. Pachos. Implementation of a content-scanning module for an internet firewall. In IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM), Napa, CA, USA, Apr. 2003.
10. Network World Fusion. Gigabit intrusion-detection systems. http://www.nwfusion.com/reviews/2002/1104rev.html.
11. M. Roesch. Snort - lightweight intrusion detection for networks. In 13th Administration Conference, LISA'99, Seattle, WA, Nov. 1999.
12. D. V. Schuehler and J. Lockwood. TCP-Splitter: A TCP/IP Flow Monitor in Reconfigurable Hardware. InProceedings of Symposium on High Performance Interconnects (HotI'02), pages 127-131, Stanford, CA, USA, Aug. 2002.
13. R. Sidhu and V. K. Prasanna. Fast regular expression matching using FPGAs. In IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM), Rohnert Park, CA, USA, Apr. 2001.
14. K. Thompson, G. J. Miller, and F. Wilder. Wide-area internet traffic patterns and characteristics. IEEE Network Magazine, vol 11 no. 6:10-23, Nov/Dec 1997.