Granidt: Towards Gigabit Rate Network Intrusion Detection Technology
We describe a novel application of reconfigurable computing to the problem of computer network security. By filtering network packets with customized logic circuits, we can search headers as well as packet content for specific signatures at Gigabit Ethernet line rate. Input to our system is a set of filter rule descriptions in the format of the public domain “snort” databases. These descriptions are used by the hardware circuits on two Xilinx Virtex 1000 FPGAs on a SLAAC1V board. Packets are read from a Gigabit Ethernet interface card, the GRIP , and flow directly through the packet filtering circuits. A vector describing matching packet headers and content are returned to the host program, which relates matches back to the rule database, so that logs or alerts can be generated. The hardware runs at 66 MHz with 32-bit data, giving an effective line rate of 2 Gb/s. The granidt combination software/hardware runs at 24.9X the speed of snort 1.8.
Unable to display preview. Download preview PDF.
- William Cheswick and Steven Bellovin. Firewalls and Internet Security. Addison-Wesley, 1994.Google Scholar
- R. Franklin et al. Assisting network intrusion detection with reconfigurable hardware. IEEE FCCM 2002, 2002.Google Scholar
- Joshua W. Haines, Richard P. Lippmann, David J. Fried, et al. 1999 darpa intrusion detection system evaluation: Design and procedures. MIT Lincoln Laboratory Technical Report, 2001.Google Scholar
- Steven McCanne and Van Jacobson. The BSD packet filter: A new architecture for user-level packet capture. In USENIX Winter, pages 259–270, 1993.Google Scholar
- J. McHenry et al. An fpga-based co-processor for atm firewalls. IEEE FCCM 2002, 1997.Google Scholar
- IntruVert Networks. http://www.intruvert.com. 2002.
- Martin Roesch. Snort: The open source network intrusion detection system. http://www.snort.org, 2002.