loading...
 This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM'04)
Pre-Decoded CAMs for Efficient and High-Speed NIDS Pattern Matching
Napa, California
April 20-April 23
ISBN: 0-7695-2230-0
Ioannis Sourdis, Technical University of Crete, Chania, Greece
Dionisios Pnevmatikatos, Foundation for Research and Technology-Hellas (FORTH), Greece
In this paper we advocate the use of pre-decoding for CAM-based pattern matching. We implement an FPGA based sub-system for NIDS (Snort) pattern matching using a combination of techniques. First, we reduce the area cost of character matching using (i) character pre-decoding before they are compared in the CAM line, and (ii) efficient shift register implementation using the SRL16 Xilinx cell. Then we achieve high operating frequencies by (iii) using fine grain pipelining for faster circuits and (iv) decoupling the data distribution network from the processing components. Our results show that for matching more than 18,000 characters (the entire SNORT rule set) our implementation requires an area cost of less than 1.1 logic cells per matched character, achieving an operating frequency of about 375 MHz (3 Gbps) on a Virtex2 device. When using quad parallelism to increase the matching throughput, the area cost of a single matched character is reduced to less than one logic cell for a throughput of almost 10 Gbps.
Citation:
Ioannis Sourdis, Dionisios Pnevmatikatos, "Pre-Decoded CAMs for Efficient and High-Speed NIDS Pattern Matching," fccm, pp.258-267, 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines (FCCM'04), 2004
Usage of this product signifies your acceptance of the Terms of Use.