Novel FPGA-Based Signature Matching for Deep Packet Inspection - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2010

Novel FPGA-Based Signature Matching for Deep Packet Inspection

Résumé

Deep packet inspection forms the backbone of any Network Intrusion Detection (NID) system. It involves matching known malicious patterns against the incoming traffic payload. Pattern matching in software is prohibitively slow in comparison to current network speeds. Thus, only FPGA (Field-Programmable Gate Array) or ASIC (Application-Specific Integrated Circuit) solutions could be efficient for this problem. Our FPGA-based solution performs high-speed matching while permitting pattern updates without resource reconfiguration. An off-line optimization method first finds sub-pattern similarities across all the patterns in the SNORT database of signatures [17]. A novel technique then compresses each pattern into a bit vector where each bit represents such a sub-pattern. Our approach reduces drastically the required on-chip storage as well as the complexity of matching, utilizing just 0.05 logic cells for processing and 17.74 bits for storage per character in the current SNORT database of 6456 patterns.
Fichier principal
Vignette du fichier
60330263.pdf (543.54 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01056079 , version 1 (14-08-2014)

Licence

Paternité

Identifiants

Citer

Nitesh B. Guinde, Sotirios G. Ziavras. Novel FPGA-Based Signature Matching for Deep Packet Inspection. 4th IFIP WG 11.2 International Workshop on Information Security Theory and Practices: Security and Privacy of Pervasive Systems and Smart Devices (WISTP), Apr 2010, Passau, Germany. pp.261-276, ⟨10.1007/978-3-642-12368-9_21⟩. ⟨hal-01056079⟩
98 Consultations
169 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More