Improved TCAM-Based Pre-Filtering for Network Intrusion Detection Systems

Abstract

Abstract-With the increasing growth of the Internet, the explosion of attacks and viruses significantly affects the network security. Network Intrusion Detection System (NIDS) is developed to identify these network attacks by a set of rules. However, searching for multiple patterns is a computationally expensive task in NIDS. Traditional software-based solutions can not meet the high bandwidth demanded in current high-speed networks. In the past, the pre-filtering designed for NIDS is an effective technique that can reduce the processing overhead significantly. A FNPlike TCAM searching engine (FTSE) [5][6] is an example that uses an 2-stage architecture to detect whether an incoming string contains patterns.In this paper, we propose two techniques to improve the performance of FTSE that utilizes ternary content addressable memory (TCAM) as pre-filter to achieve gigabit performance. The first technique performs the w-byte suffix pattern match instead of using w-byte prefix. The second technique finds the matching results from all groups rather than first group. We finally present the simulation result using Snort pattern set and DEFCON packet traces.

Towards Effective Trust-Based Packet Filtering in Collaborative Network Environments

“…Previous studies (e.g., [4], [16]) have shown that constructing an appropriate filtration mechanism is a promising way to handle overhead packets. Motivated by this line of research, we developed a trust-based packet filter using Bayesian inference to help reduce a large number of network packets for a single NIDS [21], where the trust-based approach was proven to be better than a statistic-based method [20], [23].…”

“…Later, Chang et al [4] provided two techniques to improve the FNP-like TCAM searching engine (FTSE) in high-speed networks, which was a two-stage architecture in detecting whether an incoming string contains patterns. The first approach performs pattern matching with a w-byte suffix instead of a w-byte prefix; and the second approach leverages the matching results from all groups excluding the first group.…”

A resistive TCAM accelerator for data-intensive computing

“…With technology scaling over the last 20 years, TCAM capacity has increased from 64Kb [57] to 9Mb [26], while typical array width has grown from 72 bits to 576 bits. Numerous networking applications have emerged to leverage the benefits of TCAM, including packet classification [29], access control list filtering [39], and network intrusion detection [11]. Table 1 shows a comparison among CMOS-based TCAM, SRAM, and DRAM chips.…”