String alignment pre-detection using unique subsequences for FPGA-based network intrusion detection

In this work, we propose a multi-character hardware-based solution using non-deterministic finite automata, NFA, for network intrusion detection. Our approach uses unique subsequence matching. This is a real-time preprocessing phase for detecting the possible presence and the corresponding alignment...

Full description

Saved in:
Bibliographic Details
Published in:Computer communications 2012-03, Vol.35 (6), p.720-728
Main Authors: Bande Serrano, José M., Palancar, José Hernández
Format: Article
Language:English
Subjects:
FPGA
NFA
NIDS
String matching
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:In this work, we propose a multi-character hardware-based solution using non-deterministic finite automata, NFA, for network intrusion detection. Our approach uses unique subsequence matching. This is a real-time preprocessing phase for detecting the possible presence and the corresponding alignment of the string in the data flow. In doing so, we make a reduction of the area cost for processing multiples characters. Instead of replicating the hardware by splitting the NFAs for each string alignment regarding the block of characters accepted at each cycle, we arrange the NFAs input so they match with the correct string alignment. The architecture is fully pipelined in order to reduce the latency. Taking four characters at the input we achieve multi gigabits throughputs, at the time that thousands of strings can be matched.
ISSN:0140-3664
1873-703X
DOI:10.1016/j.comcom.2011.12.009