A pattern matching co-processor for network security
Authors:
- 1 January 2005
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- No. 0738100X,p. 234-239
Abstract
It has been estimated that computer network worms and virus caused the loss of over $55B in 2003. Network security system use techniques such as deep packet inspection to detect the harmful packets. While software intrusion detection system running on general purpose processors can be updated in response to new attacks. They lack the processing power to monitor gigabit networks. We present a high performance pattern matching co-processor architecture that can be used to monitor and identify a large number of intrusion signature. The design consists of a bank of pattern matchers that are used to implement a highly concurrent filter. The pattern matchers can be programmed to match multiple patterns of various lengths, and are able to leverage the existing databases of threat signatures. We have been able to program the filters to match all the payload patterns defined in the widely used Snort network intrusion detection system at a rate above 7 Gbps, with memory space left to accommodate threat signatures that become available in the future.Keywords
This publication has 7 references indexed in Scilit:
- A Methodology for Synthesis of Efficient Intrusion Detection Systems on FPGAs2004
- Scalable Pattern Matching for High Speed Networks2004
- Deep Packet Filter with Dedicated Logic and Read Only Memories2004
- Protocol Scrubbing: Network Security Through Transparent Flow ModificationIEEE/ACM Transactions on Networking, 2004
- Fast, Large-Scale String Match for a 10Gbps FPGA-Based Network Intrusion Detection System2003
- Design and analysis of a layer seven network processor accelerator using reconfigurable logic2003
- Efficient string matchingCommunications of the ACM, 1975