High-Performance Stateful Intrusion Detection System

Abstract

This paper is related with a stateful intrusion detection technology which is based on session state tracking in network intrusion detection systems(NIDSs). Today's network security systems are required high-performance as well as good functionality since the speed of the internet is increasing. But most of the software-based NIDSs(e.g. Snort) show inefficiency and even fail to perform for thefaster internet. In this paper, we provide hardwarebased stateful intrusion detection module to overcome these shortcomings of software-based solutions. By implementing stateful intrusion detection module in FPGA, we can solve the problem ofperformance and has capability of intrusion detection in future multigigabit network environment. In addition, we can improve the accuracy of intrusion detection with reducingfalse positive alerts.

A configurable-hardware document-similarity classifier to detect web attacks

“…These approaches typically compile rulesets into hardware in a way that leverages either the distributed memory resources of an FPGA or its ability to house large amounts of logic. Memory-based approaches include TCAMs [12], hash dictionaries [13], and parallel Bloom filters [4]. Logic-based approaches such as DFA or NFA [3] typically instantiate a large number of hardware state machines to compare many different patterns at the same time.…”

A Survey on Deep Packet Inspection for Intrusion Detection Systems

“…Selective multi-character transitions /FPGA [37] Xilinx XC2V6000-6 14 B-FSM/(FPGA or ASIC) [45] Xilinx Virtex-4 10∼20 nnn/SRAM [3] FPGA/ASIC 1∼20 RTCAM [46] TCAM 12.35 Pre-Decoded CAM [36] Virtex 2-6000 9.7 Quad Bloom Filter/FPGA [6] Xilinx Virtex4 20.4 BITWISE CAM [50] FPGA Xilinx XC2V8000 2.5 FPGA [18] Virtex-4 10 UCLA Packet/FPGA [11] Xilinx Spartan 3-XC3S2000 3.2 NFA/(FPGA and IXP) [12] Xilinx Virtex2-6000&IXP 2400 1 GaTech Decoder Trees/FPGA [13] Virtex 2-8000 2 WashU Bloom/FPGA [5] Virtex 4-100 20.4 Hash Function [49] Xilinx Vertex-II Pro XC2VP70 2 Hash Function and CRC [30] Xilinx Vertex2 2.712 ∼ 4.560 TCAM/Network Processor [38] Network Processor IXDP28xx [22] 10 state. Manipulating multiple DTs means that multiple memory accesses are required which decrease the DPI process throughput.…”