Abstract:Pattern matching is one of the most performance-critical components for the content inspection based applications of network security, such as network intrusion detection and prevention. To keep up with the increasing speed network, this component needs to be accelerated by well designed custom coprocessor. This paper presents a parameterized multilevel pattern matching architecture (MPM) which is used on FPGAs. To achieve less chip area, the architecture is designed based on the idea of selected character decoding (SCD) and multilevel method which are analyzed in detail. This paper also proposes an MPM generator that can generate RTL-level codes of MPM by giving a pattern set and predefined parameters. With the generator, the efficient MPM architecture can be generated and embedded to a total hardware solution. The third contribution is a mathematical model and formula to estimate the chip area for each MPM before it is generated, which is useful for choosing the proper type of FPGAs. One example MPM architecture is implemented by giving 1785 patterns of Snort on Xilinx Virtex 2 Pro FPGA. The results show that this MPM can achieve 4.3 Gbps throughput with 5 stages of pipelines and 0.22 slices per character, about one half chip area of the most area-efficient architecture in literature. Other results are given to show that MPM is also efficient for general random pattern sets. The performance of MPM can be scalable near linearly, potential for more than 100 Gbps throughput.

A Scalable Pattern Matching Implementation on Hardware Using Data Level Parallelism

Multi-Gigabit Rate Pattern-Matching Engine Using Grouping CAM/TCAM

Variable Length Pattern Matching for Hardware Network Intrusion Detection System

A Common On-board Hardware Architecture for Intrusion Detection System

Parallel Network Intrusion Detection On Reconfigurable Platforms

Multilevel Pattern Matching Architecture for Network Intrusion Detection and Prevention System

FPGA based High speed and low area cost pattern matching

Embedded network processor based parallel intrusion detection

Efficient Wu-Manber Pattern Matching Hardware for Intrusion and Malware Detection

Fine-grained Parallel Multi-pattern Matching for Backbone Network NIDS

A Parameterized Multilevel Pattern Matching Architecture on FPGAs for Network Intrusion Detection and Prevention.

Intrusion Detection And Simulation For High-Speed Networks

Ultra-High Throughput String Matching for Deep Packet Inspection

Fast Dynamic Pattern Matching for Deep Packet Inspection

A Fast Multi-pattern Matching Algorithm for Deep Packet Inspection on a Network Processor

Fast regular expression matching in hardware using NFA-BDD combination

A Memory-Efficient Parallel String Matching Architecture for High-Speed Intrusion Detection

A Parallel Nids Pattern Matching Engine and Its Implementation on Network Processor

Scalable string matching framework enhanced by pattern clustering

A High Performance and Scalable Packet Pattern-Matching Architecture

High-performance multi-pattern matching structure in hardware network firewall