Abstract
Pattern matching is one of critical parts of Network Intrusion Prevention Systems (NIPS). Pattern matching hardware for NIPS should find a matching pattern at wire speed. However, that alone is not good enough. First, pattern matching hardware should be able to generate sufficient pattern match information including the pattern index number and the location of the match found at wire speed. Second, it should support pattern grouping to reduce unnecessary pattern matches. Third, it should show constant worst-case performance even if the number of patterns is increased. Finally it should be able to update patterns in a few minutes or seconds without stopping its operations. We modify Shift-OR hardware accelerator and propose a system architectures to meet the above requirement. Using Xilinx FPGA simulation, we show the new system scaled well to achieve a high speed over 10Gbps and satisfies all of the above requirements.
This work was supported by 2005 Korea Sanhank Foundation Research Fund.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Code Red worm exploiting buffer overflow in IIS indexing service DLL. CERT Advisory CA-2001-19 (2002)
MS-SQL Server Worm. CERT Advisory CA-2003-04 (2003)
Zhang, X., Li, C., Zheng, W.: Intrusion Prevention System Design. In: The Fourth International Conference on Computer and Information Technology (CIT 2004) (2004)
Snort, http://www.snort.org
Antonatos, S., Anagnostakis, K.G., Markatos, E.P.: Generating Realistic Workloads for Network Intrusion Detection Systems. In: Proceedings of ACM Workshop on Software and Performance (2004)
Tuck, N., Sherwood, T., Calder, B., Varghese, G.: Deterministic Memory-Efficient String Matching Algorithms for Intrusion Detection. In: Proceedings of the 23rd Conference of the IEEE Communication Society (INFOCOM 2004) (2004)
Liu, R., Huang, N., Chen, C., Kao, C.: A Fast String Matching Algorithm for Network Processor Based Intrusion Detection System. ACM Transaction on Embedded Computing Systems 3, 614–633 (2004)
Kim, S.: Pattern Matching Acceleration for Network Intrusion Detection Systems. In: Hämäläinen, T.D., Pimentel, A.D., Takala, J., Vassiliadis, S. (eds.) SAMOS 2005. LNCS, vol. 3553, pp. 289–298. Springer, Heidelberg (2005)
Tan, L., Sherwood, T.: A High Throughput String Matching Architecture for Intrusion Detection and Prevention. In: The 32nd Annual International Symposium on Computer Architecture (2005)
Moore, D., Shannon, C., Voelker, G.M., Savage, S.: Internet Quarantine: Requirements for Containing Self-Propagating Code. In: IEEE INFOCOM (2003)
Dharmapurikar, S., Krishnamurthy, P., Sproull, T., Lockwood, J.: Deep Packet Inspection Using Parallel Bloom Filters. In: Proceedings of the Symposium on High Performance Interconnects (HotI), pp. 44–51 (2003)
Hutchings, B.L., Franklin, R., Carver, D.: Assisting Network Intrusion Detection with Reconfigurable Hardware. In: Proceedings of the 10th Annual IEEE Symposium on Field-Programmable Custom Computing Machines (2002)
Moscola, J., Lockwood, J., Loui, R.P., Pachos, M.: Implementation of a Content-Scanning Module for an Internet Firewall. In: Proceedings of the IEEE Symposium on Field-Programmable Custom Computing Machines (2003)
Gokhale, M., Dubois, D., Dubois, A., Boorman, M., Poole, S., Hogsett, V.: Granidt: Towards Gigabit Rate Network Intrusion Detection Technology. In: Glesner, M., Zipf, P., Renovell, M. (eds.) FPL 2002. LNCS, vol. 2438, p. 404. Springer, Heidelberg (2002)
Sourdis, I., Pnevmatikatos, D.: Pre-decoded CAMs for Efficient and High-Speed NIDS Pattern Matching. In: Proceeding of the 12th Annual IEEE Symposium on Field Programmable Custom Computing Machines (2004)
Cho, Y.H., Mangione-Smith, W.H.: Programmable Hardware for Deep Packet Filtering on a Large Signature Set. In: Workshop on Architectural Support for Security and Anti-Virus (2004)
Cho, Y.H., Mangione-Smith, W.H.: Deep Packet Filter with Dedicated Logic and Read Only Memories. In: Proceedings of the 12th IEEE Symposium of Field-Programmable Custom Computing Machines (2004)
Aho, A.V., Corasick, M.J.: Efficient String Matching: An Aid to Bibliographic Search. Communications of the ACM 18, 333–340 (1975)
Baeza-Yates, R.A., Gonnet, G.H.: A New Approach to Text Searching. In: Proceedings of ACM 12th International Conference on Research and Development in Information Retrieval (1989)
Xilinx, Inc., http://www.xilinx.com
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2006 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Kim, D.Y., Kim, S., Choi, L., Kim, H. (2006). A High-Throughput System Architecture for Deep Packet Filtering in Network Intrusion Prevention. In: Grass, W., Sick, B., Waldschmidt, K. (eds) Architecture of Computing Systems - ARCS 2006. ARCS 2006. Lecture Notes in Computer Science, vol 3894. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11682127_29
Download citation
DOI: https://doi.org/10.1007/11682127_29
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-32765-3
Online ISBN: 978-3-540-32766-0
eBook Packages: Computer ScienceComputer Science (R0)