Granidt: Towards Gigabit Rate Network Intrusion Detection Technology
- Cite this paper as:
- Gokhale M., Dubois D., Dubois A., Boorman M., Poole S., Hogsett V. (2002) Granidt: Towards Gigabit Rate Network Intrusion Detection Technology. In: Glesner M., Zipf P., Renovell M. (eds) Field-Programmable Logic and Applications: Reconfigurable Computing Is Going Mainstream. FPL 2002. Lecture Notes in Computer Science, vol 2438. Springer, Berlin, Heidelberg
We describe a novel application of reconfigurable computing to the problem of computer network security. By filtering network packets with customized logic circuits, we can search headers as well as packet content for specific signatures at Gigabit Ethernet line rate. Input to our system is a set of filter rule descriptions in the format of the public domain “snort” databases. These descriptions are used by the hardware circuits on two Xilinx Virtex 1000 FPGAs on a SLAAC1V board. Packets are read from a Gigabit Ethernet interface card, the GRIP , and flow directly through the packet filtering circuits. A vector describing matching packet headers and content are returned to the host program, which relates matches back to the rule database, so that logs or alerts can be generated. The hardware runs at 66 MHz with 32-bit data, giving an effective line rate of 2 Gb/s. The granidt combination software/hardware runs at 24.9X the speed of snort 1.8.
Unable to display preview. Download preview PDF.