Novel FPGA-based signature matching for deep packet inspection

Nitesh B. Guinde, Sotirios G. Ziavras

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Deep packet inspection forms the backbone of any Network Intrusion Detection (NID) system. It involves matching known malicious patterns against the incoming traffic payload. Pattern matching in software is prohibitively slow in comparison to current network speeds. Thus, only FPGA (Field-Programmable Gate Array) or ASIC (Application- Specific Integrated Circuit) solutions could be efficient for this problem. Our FPGA-based solution performs high-speed matching while permitting pattern updates without resource reconfiguration. An off-line optimization method first finds sub-pattern similarities across all the patterns in the SNORT database of signatures [17]. A novel technique then compresses each pattern into a bit vector where each bit represents such a sub-pattern. Our approach reduces drastically the required on-chip storage as well as the complexity of matching, utilizing just 0.05 logic cells for processing and 17.74 bits for storage per character in the current SNORT database of 6456 patterns.

Original languageEnglish (US)
Title of host publicationInformation Security Theory and Practices
Subtitle of host publicationSecurity and Privacy of Pervasive Systems and Smart Devices - 4th IFIP WG 11.2 International Workshop, WISTP 2010, Proceedings
Pages261-276
Number of pages16
DOIs
StatePublished - 2010
Event4th IFIP WG 11.2 International Workshop on Information Security Theory and Practices: Security and Privacy of Pervasive Systems and Smart Devices, WISTP 2010 - Passau, Germany
Duration: Apr 12 2010Apr 14 2010

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume6033 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Other

Other4th IFIP WG 11.2 International Workshop on Information Security Theory and Practices: Security and Privacy of Pervasive Systems and Smart Devices, WISTP 2010
CountryGermany
CityPassau
Period4/12/104/14/10

All Science Journal Classification (ASJC) codes

  • Theoretical Computer Science
  • Computer Science(all)

Fingerprint Dive into the research topics of 'Novel FPGA-based signature matching for deep packet inspection'. Together they form a unique fingerprint.

Cite this