This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Traffic-Aware Design of a High-Speed FPGA Network Intrusion Detection System
Nov. 2013 (vol. 62 no. 11)
pp. 2322-2334
Salvatore Pontarelli, University of Rome "Tor Vergata," Rome
Giuseppe Bianchi, University of Rome "Tor Vergata," Rome
Simone Teofili, University of Rome "Tor Vergata," Rome
Security of today's networks heavily rely on network intrusion detection systems (NIDSs). The ability to promptly update the supported rule sets and detect new emerging attacks makes field-programmable gate arrays (FPGAs) a very appealing technology. An important issue is how to scale FPGA-based NIDS implementations to ever faster network links. Whereas a trivial approach is to balance traffic over multiple, but functionally equivalent, hardware blocks, each implementing the whole rule set (several thousands rules), the obvious cons is the linear increase in the resource occupation. In this work, we promote a different, traffic-aware, modular approach in the design of FPGA-based NIDS. Instead of purely splitting traffic across equivalent modules, we classify and group homogeneous traffic, and dispatch it to differently capable hardware blocks, each supporting a (smaller) rule set tailored to the specific traffic category. We implement and validate our approach using the rule set of the well-known Snort NIDS, and we experimentally investigate the emerging trade-offs and advantages, showing resource savings up to 80 percent based on real-world traffic statistics gathered from an operator's backbone.
Index Terms:
Computer architecture,Field programmable gate arrays,Intrusion detection,Logic gates,traffic awareness,Deep packet inspection,FPGA,intrusion detection system,Snort,string matching
Citation:
Salvatore Pontarelli, Giuseppe Bianchi, Simone Teofili, "Traffic-Aware Design of a High-Speed FPGA Network Intrusion Detection System," IEEE Transactions on Computers, vol. 62, no. 11, pp. 2322-2334, Nov. 2013, doi:10.1109/TC.2012.105
Usage of this product signifies your acceptance of the Terms of Use.