Energy efficient and high throughput prefix-based pattern matching technique on TCAMs for NIDS

• Published in: Integration (Amsterdam) 2025-03, Vol.101, Article 102310
• Main Authors: Shaik, Sameera, Vegesna, S.M. Srinivasavarma, S.K., Noor Mahammad
• Format: Article
• Language: English
• Subjects: Deep packet inspection; Networking hardware; Security and privacy; TCAM
• ISSN: 0167-9260
• DOI: 10.1016/j.vlsi.2024.102310

Intrusion Detection System (IDS) is a type of packet filtering that ensures network security by analyzing the packets flowing through the network and detecting any malicious pattern(s) present in them. In signature-based NIDS, pattern matching is the critical step as it determines the system’s performance. The throughput of the system, inherently, relies on the delay required to match an input pattern. Hardware-based high-speed pattern matching algorithms are popularly used to speed up the pattern matching process and improve the system’s performance. Ternary Content Addressable Memory (TCAM) is one such memory in which the input pattern is simultaneously launched on all the match lines. Since all the match lines and search lines are activated at a given instance, the power consumed per search is extremely high. To address this issue, this paper proposes an approach in which the match is carried out with an n-bit prefix of the input pattern that enables a smaller TCAM unit, which contains the patterns having this prefix. A significant improvement in energy is observed since a single TCAM segment is enabled for a single search. The results are compared with existing solutions, and energy improvement of 96.1% is observed with worst case and best case throughput of 17Gbps and 148Gbps, respectively. •This paper proposes a high throughput pattern matching technique based on prefix based grouping of the rules.•A detailed analysis of the latest Snort rule database is presented for the better understanding of the rules.•Prefix-based grouping of the rules, mapping them on to TCAMs, search procedure are explained with the help of algorithms, figures and suitable examples.•The proposed design is evaluated in terms of throughput, energy consumption for the latest standard Snort datasets.•A significant reduction in energy and delay per search is observed (96.1% and 87.5% respectively).