String Matching Technique Based on Hardware: A Comparative Analysis
Network Intrusion Detection Systems is one of the most effective way of providing security to those connected to the network, and the string matching algorithm is the heart of the intrusion detection system. IDS checks both packet header and payload in order to detect content-based security threats.Payload scan requires efficient string matching techniques, since each incoming packet must be compared against the hundreds of known attacks. Checking every byte of every packet to see if it matches one of a set of ten thousand strings becomes a computationally intensive task as network speeds grows up. For high speed networks it can be difficult to keep up with intrusion detection using purely software approach without affecting performance of the system intended for designed application. It is essential to use hardware systems for intrusion detection. A string matching algorithm is implemented in hardware with the focus on increasing throughput, and reasonable area cost while maintaining the configurability provided by the software IDSs. This paper consist a review of different string matching techniques implemented in FPGA for detecting malicious packet over the network.
KeywordsField Programmable Gate Array Network intrusion detection String matching
Unable to display preview. Download preview PDF.
- 1.Babu Karuppiah, A., Rajaram, S.: Deterministic Finite Automata for Pattern Matching in FPGA for intrusion Detection. In: International Conference on Computer and Electrical Technoogy, ICCCET 2011, March 18-19 (2011)Google Scholar
- 2.Nakahara, H., Sasao, T., Matsuura, M.: A Regular Expression Matching Using Non-Deterministic Finite Automata. IEEE (2010)Google Scholar
- 3.Bonesana, I., Paolieri, M., Santambrogio, M.D.: An adaptable FPGA based system for regular expression Matching. IEEE (2008)Google Scholar
- 4.Aldwairi, M., Conte, T., Franzon, P.: Configurable string Matching Hardware for Speeding up Intrusion detection. ACM SIGARCH Computer Architecture News 33(1) (March 2005)Google Scholar
- 5.Tummala, A.K., Patel, P.: Distributed IDS using Reconfigurable Hardware. IEEE (2007)Google Scholar
- 6.Le, H., Prasanna, V.K.: Ming Hsieh Department of Electrical Engineering University of Southern California Los Angeles, CA 90089, USA A Memory-Efficient and Modular Approach for String Matching on FPGAs (2010)Google Scholar
- 7.Dhanapriya, M., Vasanthanayaki, C.: Hardware Based Pattern Matching Technique for Packet Inspection of High Speed Network. In: International Conference on Control, Automation, Communication and Energy Consevation 2009, June 4-6 (2009)Google Scholar
- 8.Sourdis, I., Pnevmatikatos, D.N., Vassiladis, S.: Scalable Multigigabit Pattern Matching for Packet Inspection. In: Proc. IEEE Symp. Field Program. Custom Comput. (February 2008)Google Scholar
- 9.Hutchings, B.L., Franklin, R., Carver, D.: Scalable hardware implementation usonf Finite Automata. Department of Electrical and Computer Engin.Google Scholar
- 11.Hasan, J., Cadambi, S., Jakkula, V., Chakradhar, S.: Chisel: A Storage-efficient, Collision-free Hash-based Network Processing Architecture. In: 33rd International Symposium on Computer Architecture, pp. 203–215Google Scholar
- 12.Sidhu, R., Prasanna, V.K.: Fast Regular Expression Matching using FPGAs. In: 9th Annual Symposium IEEE (2001)Google Scholar