A high-throughput system architecture for deep packet filtering in network intrusion prevention

Dae Y. Kim, Sunil Kim, Lynn Choi, Hyogon Kim

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)

Abstract

Pattern matching is one of critical parts of Network Intrusion Prevention Systems (NIPS). Pattern matching hardware for NIPS should find a matching pattern at wire speed. However, that alone is not good enough. First, pattern matching hardware should be able to generate sufficient pattern match information including the pattern index number and the location of the match found at wire speed. Second, it should support pattern grouping to reduce unnecessary pattern matches. Third, it should show constant worst-case performance even if the number of patterns is increased. Finally it should be able to update patterns in a few minutes or seconds without stopping its operations. We modify Shift-OR hardware accelerator and propose a system architectures to meet the above requirement. Using Xilinx FPGA simulation, we show the new system scaled well to achieve a high speed over 10Gbps and satisfies all of the above requirements.

Original languageEnglish
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Pages407-421
Number of pages15
Volume3894 LNCS
Publication statusPublished - 2006 Jul 10
Event19th International Conference on Architecture of Computing Systems, ARCS 2006 - Frankfurt, Main, Germany
Duration: 2006 Mar 132006 Mar 16

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume3894 LNCS
ISSN (Print)03029743
ISSN (Electronic)16113349

Other

Other19th International Conference on Architecture of Computing Systems, ARCS 2006
CountryGermany
CityFrankfurt, Main
Period06/3/1306/3/16

Fingerprint

Pattern matching
System Architecture
High Throughput
Filtering
Throughput
Pattern Matching
Hardware
Wire
Hardware Accelerator
Particle accelerators
Field programmable gate arrays (FPGA)
Worst-case Performance
Requirements
Grouping
Field Programmable Gate Array
High Speed
Update
Sufficient
Simulation

ASJC Scopus subject areas

  • Computer Science(all)
  • Biochemistry, Genetics and Molecular Biology(all)
  • Theoretical Computer Science

Cite this

Kim, D. Y., Kim, S., Choi, L., & Kim, H. (2006). A high-throughput system architecture for deep packet filtering in network intrusion prevention. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (Vol. 3894 LNCS, pp. 407-421). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 3894 LNCS).

A high-throughput system architecture for deep packet filtering in network intrusion prevention. / Kim, Dae Y.; Kim, Sunil; Choi, Lynn; Kim, Hyogon.

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 3894 LNCS 2006. p. 407-421 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 3894 LNCS).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Kim, DY, Kim, S, Choi, L & Kim, H 2006, A high-throughput system architecture for deep packet filtering in network intrusion prevention. in Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). vol. 3894 LNCS, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 3894 LNCS, pp. 407-421, 19th International Conference on Architecture of Computing Systems, ARCS 2006, Frankfurt, Main, Germany, 06/3/13.
Kim DY, Kim S, Choi L, Kim H. A high-throughput system architecture for deep packet filtering in network intrusion prevention. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 3894 LNCS. 2006. p. 407-421. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).
Kim, Dae Y. ; Kim, Sunil ; Choi, Lynn ; Kim, Hyogon. / A high-throughput system architecture for deep packet filtering in network intrusion prevention. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics). Vol. 3894 LNCS 2006. pp. 407-421 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).
@inproceedings{a250ee7b7a7e4657903a35256aa81661,
title = "A high-throughput system architecture for deep packet filtering in network intrusion prevention",
abstract = "Pattern matching is one of critical parts of Network Intrusion Prevention Systems (NIPS). Pattern matching hardware for NIPS should find a matching pattern at wire speed. However, that alone is not good enough. First, pattern matching hardware should be able to generate sufficient pattern match information including the pattern index number and the location of the match found at wire speed. Second, it should support pattern grouping to reduce unnecessary pattern matches. Third, it should show constant worst-case performance even if the number of patterns is increased. Finally it should be able to update patterns in a few minutes or seconds without stopping its operations. We modify Shift-OR hardware accelerator and propose a system architectures to meet the above requirement. Using Xilinx FPGA simulation, we show the new system scaled well to achieve a high speed over 10Gbps and satisfies all of the above requirements.",
author = "Kim, {Dae Y.} and Sunil Kim and Lynn Choi and Hyogon Kim",
year = "2006",
month = "7",
day = "10",
language = "English",
isbn = "3540327657",
volume = "3894 LNCS",
series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",
pages = "407--421",
booktitle = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

}

TY - GEN

T1 - A high-throughput system architecture for deep packet filtering in network intrusion prevention

AU - Kim, Dae Y.

AU - Kim, Sunil

AU - Choi, Lynn

AU - Kim, Hyogon

PY - 2006/7/10

Y1 - 2006/7/10

N2 - Pattern matching is one of critical parts of Network Intrusion Prevention Systems (NIPS). Pattern matching hardware for NIPS should find a matching pattern at wire speed. However, that alone is not good enough. First, pattern matching hardware should be able to generate sufficient pattern match information including the pattern index number and the location of the match found at wire speed. Second, it should support pattern grouping to reduce unnecessary pattern matches. Third, it should show constant worst-case performance even if the number of patterns is increased. Finally it should be able to update patterns in a few minutes or seconds without stopping its operations. We modify Shift-OR hardware accelerator and propose a system architectures to meet the above requirement. Using Xilinx FPGA simulation, we show the new system scaled well to achieve a high speed over 10Gbps and satisfies all of the above requirements.

AB - Pattern matching is one of critical parts of Network Intrusion Prevention Systems (NIPS). Pattern matching hardware for NIPS should find a matching pattern at wire speed. However, that alone is not good enough. First, pattern matching hardware should be able to generate sufficient pattern match information including the pattern index number and the location of the match found at wire speed. Second, it should support pattern grouping to reduce unnecessary pattern matches. Third, it should show constant worst-case performance even if the number of patterns is increased. Finally it should be able to update patterns in a few minutes or seconds without stopping its operations. We modify Shift-OR hardware accelerator and propose a system architectures to meet the above requirement. Using Xilinx FPGA simulation, we show the new system scaled well to achieve a high speed over 10Gbps and satisfies all of the above requirements.

UR - http://www.scopus.com/inward/record.url?scp=33745602206&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=33745602206&partnerID=8YFLogxK

M3 - Conference contribution

SN - 3540327657

SN - 9783540327653

VL - 3894 LNCS

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 407

EP - 421

BT - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

ER -