Scalable Multigigabit Pattern Matching for Packet Inspection

Abstract

Abstract-In this paper, we consider hardware-based scanning and analyzing packets payload in order to detect hazardous contents. We present two pattern matching techniques to compare incoming packets against intrusion detection search patterns. The first approach, decoded partial CAM (DpCAM), predecodes incoming characters, aligns the decoded data, and performs logical AND on them to produce the match signal for each pattern. The second approach, perfect hashing memory (PHmem), uses perfect hashing to determine a unique memory location that contains the search pattern and a comparison between incoming data and memory output to determine the match. Both techniques are well suited for reconfigurable logic and match about 2200 intrusion detection patterns using a single Virtex2 field-programmable gate-array device. We show that DpCAM achieves a throughput between 2 and 8 Gb/s requiring 0.58-2.57 logic cells per search character. On the other hand, PHmem designs can support 2-5.7 Gb/s using a few tens of block RAMs (630-1404 kb) and only 0.28-0.65 logic cells per character. We evaluate both approaches in terms of performance and area cost and analyze their efficiency, scalability, and tradeoffs. Finally, we show that our designs achieve at least 30% higher efficiency compared to previous work, measured in throughput per area required per search character.

FASTER: Facilitating Analysis and Synthesis Technologies for Effective Reconfiguration

“…Network Intrusion Detection Systems (NIDS) [24] are widely adopted as high-speed and always-on network access demand more sophisticated packet processing and increased network security. Instead of checking only the header of incoming packets (as for example firewalls typically do), NIDS also scan the payload to detect suspicious contents.…”

Scalable multi-pipeline architecture for high performance multi-pattern string matching

“…Some excellent surveys can be found in [6], [18]. Based on the platform for implementation, the state-of-the-art solutions can be generally divided into three categories: multicore processor -based [9], [11], [19], application-specific integrated circuit (ASIC) -based [5], [8], [12], [20] and field programmable gate array (FPGA) -based [4], [15], [21], [22] solutions. Each of them has its own pros and cons.…”

“…The majority of existing FPGA-based string matching engines are based on purely logic [21], [22], [25]. Although they provide desirable high performance, it takes considerable time to resynthesize the design and reprogram the FPGA device.…”

Novel Design Methods and a Tool Flow for Unleashing Dynamic Reconfiguration

“…For example, this functionality can benefit Network Intrusion Detection Systems (NIDS), which aim at scanning all incoming packets for suspicious content [1], [2]. Scanning has to be carried out at line-speed so that the communications are not slowed down, while the list of threats to check for may be extended and updated on a daily basis.…”