String alignment pre-detection using unique subsequences for FPGA-based network intrusion detection

详细信息	查看全文 | 推荐本文 |

• 作者：José ; M. Bande Serrano ; ^{jbande@cenatav.co.cu} ; José ; Herná ; ndez Palancar ^{jpalancar@cenatav.co.cu}
• 关键词：NIDS ; String matching ; NFA ; FPGA
• 刊名：Computer Communications
• 出版年：2012
• 期刊代码：21_01403664
• 类别：cp
• 出版时间：15 March, 2012
• 卷：35
• 期：6
• 页码：720-728
• 文件大小：540 K

摘要

In this work, we propose a multi-character hardware-based solution using non-deterministic finite automata, NFA, for network intrusion detection. Our approach uses unique subsequence matching. This is a real-time preprocessing phase for detecting the possible presence and the corresponding alignment of the string in the data flow. In doing so, we make a reduction of the area cost for processing multiples characters. Instead of replicating the hardware by splitting the NFAs for each string alignment regarding the block of characters accepted at each cycle, we arrange the NFAs input so they match with the correct string alignment. The architecture is fully pipelined in order to reduce the latency. Taking four characters at the input we achieve multi gigabits throughputs, at the time that thousands of strings can be matched.