Granidt: Towards Gigabit Rate Network Intrusion Detection Technology

  • Maya Gokhale
  • Dave Dubois
  • Andy Dubois
  • Mike Boorman
  • Steve Poole
  • Vic Hogsett
Conference paper

DOI: 10.1007/3-540-46117-5_43

Part of the Lecture Notes in Computer Science book series (LNCS, volume 2438)
Cite this paper as:
Gokhale M., Dubois D., Dubois A., Boorman M., Poole S., Hogsett V. (2002) Granidt: Towards Gigabit Rate Network Intrusion Detection Technology. In: Glesner M., Zipf P., Renovell M. (eds) Field-Programmable Logic and Applications: Reconfigurable Computing Is Going Mainstream. FPL 2002. Lecture Notes in Computer Science, vol 2438. Springer, Berlin, Heidelberg

Abstract

We describe a novel application of reconfigurable computing to the problem of computer network security. By filtering network packets with customized logic circuits, we can search headers as well as packet content for specific signatures at Gigabit Ethernet line rate. Input to our system is a set of filter rule descriptions in the format of the public domain “snort” databases. These descriptions are used by the hardware circuits on two Xilinx Virtex 1000 FPGAs on a SLAAC1V [9]board. Packets are read from a Gigabit Ethernet interface card, the GRIP [8], and flow directly through the packet filtering circuits. A vector describing matching packet headers and content are returned to the host program, which relates matches back to the rule database, so that logs or alerts can be generated. The hardware runs at 66 MHz with 32-bit data, giving an effective line rate of 2 Gb/s. The granidt combination software/hardware runs at 24.9X the speed of snort 1.8.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2002

Authors and Affiliations

  • Maya Gokhale
    • 1
  • Dave Dubois
    • 1
  • Andy Dubois
    • 1
  • Mike Boorman
    • 1
  • Steve Poole
    • 1
  • Vic Hogsett
    • 1
  1. 1.Los Alamos National LaboratoryLos AlamosUSA

Personalised recommendations