Abstract
This paper presents techniques for designing pattern matching circuits for complex regular expressions, such as those found in network intrusion detection patterns. We have developed a pattern-matching co-processor that supports all the pattern matching functions of the Snort rule language [3]. In order to achieve maximum pattern capacity and throughput, the design focuses on minimizing circuit area while maintaining high clock speed. Using our approach, we are able to store the entire current Snort rule database consisting of over 1,500 rules and 17,000 characters into a single one-million-gate FPGA while comparing all patterns against traffic at gigabit rates.
Christopher R. Clark: This work was supported in part by NSF Grant 9876573 and by a grant from Intel Corporation.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
Allen, J., et al.: State of the Practice of Intrusion Detection Technologies. Technical Report CMU/SEI-99-TR-028 (1999)
Roberts, L.G.: Beyond Moore’s Law: Internet Growth Trends. IEEE Computer, 117–119 (January 2000)
Martin Roesch and Chris Green. Snort User’s Manual, http://www.snort.org
Fisk, M., Varghese, G.: Fast Content-Based Packet Handling for Intrusion Detection, Technical Report UCSD CS2001-0670 (May 2001)
Jason Coit, C., Staniford, S., McAlerney, J.: Towards Faster String Matching for Intrusion Detection. In: DARPA Information Survivability Conference (June 2001)
Sidhu, R., Prasanna, V.K.: Fast Regular Expression Matching using FPGAs. In: Proceedings of IEEE FCCM 2001 (April 2001)
Franklin, R., Carver, D., Hutchings, B.L.: Assisting Network Intrusion Detection with Reconfigurable Hardware. In: Proceedings of IEEE FCCM 2002, April 2002, pp. 111–120 (2002)
Bellows, P., Hutchings, B.L.: JHDL—An HDL for Reconfigurable Systems. In: Proceedings of IEEE FCCM 1998, April 1998, pp. 175–184 (1998)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2003 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Clark, C.R., Schimmel, D.E. (2003). Efficient Reconfigurable Logic Circuits for Matching Complex Network Intrusion Detection Patterns. In: Y. K. Cheung, P., Constantinides, G.A. (eds) Field Programmable Logic and Application. FPL 2003. Lecture Notes in Computer Science, vol 2778. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-45234-8_94
Download citation
DOI: https://doi.org/10.1007/978-3-540-45234-8_94
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-40822-2
Online ISBN: 978-3-540-45234-8
eBook Packages: Springer Book Archive