Novel FPGA-Based Signature Matching for Deep Packet Inspection - Information Security Theory and Practices. Security and Privacy of Pervasive Systems and Smart Devices Access content directly
Conference Papers Year : 2010

Novel FPGA-Based Signature Matching for Deep Packet Inspection

Abstract

Deep packet inspection forms the backbone of any Network Intrusion Detection (NID) system. It involves matching known malicious patterns against the incoming traffic payload. Pattern matching in software is prohibitively slow in comparison to current network speeds. Thus, only FPGA (Field-Programmable Gate Array) or ASIC (Application-Specific Integrated Circuit) solutions could be efficient for this problem. Our FPGA-based solution performs high-speed matching while permitting pattern updates without resource reconfiguration. An off-line optimization method first finds sub-pattern similarities across all the patterns in the SNORT database of signatures [17]. A novel technique then compresses each pattern into a bit vector where each bit represents such a sub-pattern. Our approach reduces drastically the required on-chip storage as well as the complexity of matching, utilizing just 0.05 logic cells for processing and 17.74 bits for storage per character in the current SNORT database of 6456 patterns.
Fichier principal
Vignette du fichier
60330263.pdf (543.54 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01056079 , version 1 (14-08-2014)

Licence

Attribution

Identifiers

Cite

Nitesh B. Guinde, Sotirios G. Ziavras. Novel FPGA-Based Signature Matching for Deep Packet Inspection. 4th IFIP WG 11.2 International Workshop on Information Security Theory and Practices: Security and Privacy of Pervasive Systems and Smart Devices (WISTP), Apr 2010, Passau, Germany. pp.261-276, ⟨10.1007/978-3-642-12368-9_21⟩. ⟨hal-01056079⟩
93 View
169 Download

Altmetric

Share

Gmail Facebook X LinkedIn More