Abstract
Pattern matching is one of critical parts of Network Intrusion Detection Systems (NIDS). Pattern matching is computationally intensive. To handle an increasing number of attack signature patterns, a NIDS require a multi-pattern matching method that can meet the line-speed of packet transfer. The multi-pattern matching method should efficiently handle a large number of patterns with a wide range of pattern lengths and noncase-sensitive pattern matches. It should also be able to process multiple input characters in parallel. In this paper, we propose a multi-pattern matching hardware accelerator based on Shift-OR pattern matching algorithm. We evaluate the performance of the pattern matching accelerator under various assumptions. The performance evaluation shows that the pattern matching accelerator can be more than 80 times faster than the fastest software multi-pattern matching method used in Snort, a widely used open-source NIDS.
This work was supported by 2005 Hongik University Research Fund.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Antonatos, S., Anagnostakis, K.G., Markatos, E.P.: Generating realistic workloads for network intrusion detection systems. In: Proceedings of ACM Workshop on Software and Performance (2004)
Tuck, N., Sherwood, T., Calder, B., Varghese, G.: Deterministic memory-efficient string matching algorithms for intrusion detection. In: Proceedings of the 23rd Conference of the IEEE Communication Society (INFOCOM 2004) (2004)
Liu, R., Huang, N., Chen, C., Kao, C.: A fast string matching algorithm for network processor based intrusion detection system. ACM Transaction on Embedded Computing Systems 3, 614–633 (2004)
Markatos, E.P., Antonatos, S., Polychronakis, M., Anagnostakis, K.G.: Exclusion-based signature matching for intrusion detection. In: Proceedings of the IASTED International Conference on Communications and Computer Networks (2002)
Aho, A.V., Corasick, M.J.: Efficient string matching: An aid to bibliographic search. Communications of the ACM 18, 333–340 (1975)
Wu, S., Manber, U.: AGREP - a fast approximate pattern-matching tool. In: Proceedings of the 1992 Winter USENIX Conference, San Francisco, CA (1992)
Dharmapurikar, S., Krishnamurthy, P., Sproull, T.S., Lockwood, J.W.: Deep packet inspection using parallel bloom filters. IEEE Micro 24 (2004)
Hutchings, B.L., Franklin, R., Carver, D.: Assisting network intrusion detection with reconfigurable hardware. In: Proceedings of the 10th Annual IEEE Symposium on Field-Programmable Custom Computing Machines (2002)
Sidhu, R., Prasanna, V.K.: Fast regular expression matching using FPGAs. In: Proceedings of the IEEE Symposium on Field-Programmable Custom Computing Machines (2001)
Moscola, J., Lockwood, J., Loui, R.P., Pachos, M.: Implementation of a content-scanning module for an internet firewall. In: Proceedings of the IEEE Symposium on Field-Programmable Custom Computing Machines (2003)
Gokhale, M., Dubois, D., Dubois, A., Boorman, M., Poole, S., Hogsett, V.: Granidt: Towards Gigabit rate network intrusion detection technology. In: Proceedings of the 12th International Conference on Field-Programmable Logic and Applications (2002)
Cho, Y.H., Navab, S., Mangione-Smith, W.H.: Specialized hardware for deep network packet filtering. In: Proceedings of the Field Programmable Logic and Applications (2002)
Sourdis, I., Pnevmatikatos, D.: Pre-decoded CAMs for efficient and high-speed NIDS pattern matching. In: Proceeding of the 12th Annual IEEE Symposium on Field Programmable Custom Computing Machines (2004)
Baeza-Yates, R.A., Gonnet, G.H.: A new approach to text searching. In: Proceedings of ACM 12th International Conference on Research and Development in Information Retrieval (1989)
Kun, C., Quan, S., Mason, A.: A power-optimized 64-bit priority encoder utilizing parallel priority look-ahead. In: Proceedings of the IEEE Int. Symposium on Circuits and Systems, vol. 2, pp. 753–756 (2004)
The Shmoo Group: Capture the RootFu (2005), http://www.shmoo.com/cctf/
Intel Corp.: IA-32 Intel Architecture Software Developer’s Manual, System Programming Guide, Vol. 3 (2004)
Naffziger, S., Grutkowksi, T., Stackhouse, B.: The implementation of a 2-core multi-threaded Itanium family processor. In: Proceedings of Solid-State Circuits Conference (2005)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Kim, S. (2005). Pattern Matching Acceleration for Network Intrusion Detection Systems. In: Hämäläinen, T.D., Pimentel, A.D., Takala, J., Vassiliadis, S. (eds) Embedded Computer Systems: Architectures, Modeling, and Simulation. SAMOS 2005. Lecture Notes in Computer Science, vol 3553. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11512622_31
Download citation
DOI: https://doi.org/10.1007/11512622_31
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-26969-4
Online ISBN: 978-3-540-31664-0
eBook Packages: Computer ScienceComputer Science (R0)