Deep network packet filter design for reconfigurable devices

Abstract

Most network routers and switches provide some protection against the network attacks. However, the rapidly increasing amount of damages reported over the past few years indicates the urgent need for tougher security. Deep-packet inspection is one of the solutions to capture packets that can not be identified using the traditional methods. It uses a list of signatures to scan the entire content of the packet, providing the means to filter harmful packets out of the network. Since one signature does not depend on the other, the filtering process has a high degree of parallelism. Most software and hardware deep-packet filters that are in use today execute the tasks under Von Neuman architecture. Such architecture can not fully take advantage of the parallelism. For instance, one of the most widely used network intrusion-detection systems, Snort, configured with 845 patterns, running on a dual 1-GHz Pentium III system, can sustain a throughput of only 50 Mbps. The poor performance is because of the fact that the processor is programmed to execute several tasks sequentially instead of simultaneously. We designed scalable deep-packet filters on field-programmable gate arrays (FPGAs) to search for all data-independent patterns simultaneously. With FPGAs, we have the ability to reprogram the filter when there are any changes to the signature set. The smallest full-pattern matcher implementation for the latest Snort NIDS fits in a single 400k Xilinx FPGA (Spartan 3-XC3S400) with a sustained throughput of 1.6 Gbps. Given a larger FPGA, the design can scale linearly to support a greater number of patterns, as well as higher data throughput.

Reducción de los tiempos de cómputo de la Migración Sísmica usando FPGAs y GPGPUs: Un artículo de revisión

“…Las FPGA ya han demostrado que tienen el potencial para acelerar aplicaciones de cómputo intensivo, prueba de esto es la constante publicación de procesos computacionales implementados sobre FPGA; estas publicaciones cubren áreas como: redes neuronales [23], [24], [25], [26], bús-queda de secuencias genéticas [27], [28], filtrado digital [29], [30], [31], [32], filtrado de paquetes de red [33], [34] y simulaciones financieras MonteCarlo [35], [36] entre otras. No todas las aplicaciones se pueden beneficiar de igual manera en una FPGA y debido a la dificultad que representa mapear una aplicación en estos dispositivos, Es aconsejable hacer algunas estimaciones previas con el fin determinar las posibilidades de aceleración que tendrá un algoritmo específico.…”

Scalable multi-pipeline architecture for high performance multi-pattern string matching

“…Some excellent surveys can be found in [6], [18]. Based on the platform for implementation, the state-of-the-art solutions can be generally divided into three categories: multicore processor -based [9], [11], [19], application-specific integrated circuit (ASIC) -based [5], [8], [12], [20] and field programmable gate array (FPGA) -based [4], [15], [21], [22] solutions. Each of them has its own pros and cons.…”

“…The majority of existing FPGA-based string matching engines are based on purely logic [21], [22], [25]. Although they provide desirable high performance, it takes considerable time to resynthesize the design and reprogram the FPGA device.…”

Range hash for regular expression pre-filtering

“…To get a selective yet light-weight Pre-Filter, here we select the other two components for pre-filtering: (1) exact strings and (2) CCs. Exact string matching architectures have been studied and multiple high-speed resource efficient architectures are already proposed [8,9,12,23,24,39,45], but CC detection studies are limited. Hence, our focus of this paper is to introduce a high-speed, and resource-efficient CC detector called Range Hash for RegEx pre-filtering.…”