A computationally efficient engine for flexible intrusion detection

Abstract

Pattern matching for network security and intrusion detection demands exceptionally high performance. This paper describes a novel systolic array-based string matching architecture using a buffered, two-comparator variation of the Knuth-Morris-Pratt (KMP) algorithm. The architecture compares favorably with the state-of-the-art hardwired designs while providing on-the-fly reconfiguration, efficient hardware utilization, and high clock rates. KMP is a well-known, computationally-efficient string matching technique that uses a single comparator and a precomputed transition table. Through the use of the transition table, the number of redundant comparisons performed is reduced. Through various algorithmic changes, we enable KMP to be used in hardware, providing the computational efficiency of the serial algorithm and the high throughput of a parallel hardware architecture. The efficiency of the system allows for a faster and denser implementation than any other RAM-based exact match system. We add a second comparator and an input buffer, then prove that the modified algorithm can function efficiently implemented as an element of a systolic array. The system can accept at least one character in each cycle, while guaranteeing that the stream will never stall. In this paper, we prove the bound on the buffer size and running time of the systolic array, discuss the architectural considerations involved in the FPGA implementation, and provide performance comparisons against other approaches.

Computer-Aided Endoscopic Diagnosis Without Human-Specific Labeling

“…Our algorithm is to assist the clinicians to make a final decision. In our implementation, we first set the keywords corresponding to various specific lesions, such as Gastric Cancer, Esophageal Cancer, and Esophagitis, and then, the weak label of each endoscopic image folder is mined from the text of the endoscopic medical report based on a text matching method, i.e., Knuth-Morris-Pratt [50]. If the diagnostic text does not match any of the keywords, the corresponding label of the endoscopic image folder is annotated as negative; otherwise, the label of the endoscopic image folder is annotated as positive.…”

Multi-Class Latent Concept Pooling for Computer-Aided Endoscopy Diagnosis

“…As in Wang et al [2016], we first set the keywords corresponding to various specific lesions, such as Gastric Cancer and Esophageal Cancer. Then we match the keywords with the corresponding text record based on a textmatching algorithm, that is, Knuth-Morris-Pratt [Baker and Prasanna 2005]. If the text record does not match any of the keywords, then the corresponding label of the EEMR is annotated as normal; otherwise, the label of the EEMR is annotated as the lesion related to the matched keyword.…”

Moats and Drawbridges: An Isolation Primitive for Reconfigurable Hardware Based Systems

“…If the number of possible configurations is small, then static verification is sufficient, but if the space of possible cores is infinite, then dynamic verification is necessary. For example, Baker et al have developed an intrusion detection system based on reconfigurable hardware that dynamically swaps the detection cores [2] [1]. Since the space of intrusion detection rule sets is infinite, the space of detection cores is also infinite.…”

“…To protect the key in external memory, we need to implement a memory protection module, we need to ensure that each and every memory access goes through this monitor, and we need to ensure that all cores are communicating only through their specified interfaces. To ensure these properties hold at even the lowest levels of implementation (after all the design tools have finished their transformations), we argue that slight modifications in the design methods and tools can enable the rapid static verification of finished FPGA bitstreams 2 . The techniques presented in this paper are steps towards a cohesive reconfigurable system design methodology that explicitly supports cores with varying levels of trust and criticality -all sharing a single physical device.…”