High Speed Pattern Matching for Network IDS/IPS

The phenomenal growth of the Internet in the last decade and society s increasing dependence on it has brought along, a floodof security attacks on the networking and computing infrastructure. Intrusion detection/prevention systems provide defensesagainst these attacks by monitoring headers and payload of packets flowing through the network. Multiple string matching thatcan compare hundreds of string patterns simultaneously is a critical component of these systems, and is a well-studied problem.Most of the string matching solutions today are based on the classic Aho-Corasick algorithm, which has an inherent limitation;they can process only one input character in one cycle. As memory speed is not growing at the same pace as network speed,this limitation has become a bottleneck in the current network, having speeds of tens of gigabits per second. In this paper,we propose a novel multiple string matching algorithm that can process multiple characters at a time thus achieving multi-gigabitrate search speeds. We also propose an architecture for an efficient implementation on TCAM-based hardware. We additionallypropose novel optimizations by making use of the properties of TCAMs to significantly reduce the memory requirements of theproposed algorithm. We finally present extensive simulation results of network-based virus/worm detection using real signaturedatabases to illustrate the effectiveness of the proposed scheme.