A High Throughput String Matching Architecture for Intrusion Detection and Prevention

Network Intrusion Detection and Prevention Systems have emerged as one of the most effective ways of providing security to those connected to the network, and at the heart of almost every modern intrusion detection system is a string matching algorithm. String matching is one of the most critical elements because it allows for the system to make decisions based not just on the headers, but the actual content flowing through the network. Unfortunately, checking every byte of every packet to see if it matches one of a set of ten thousand strings becomes a computationally intensive task as network speeds grow into the tens, and eventually hundreds, of gigabits/second. To keep up with these speeds a specialized device is required, one that can maintain tight bounds on worst case performance, that can be updated with new rules without interrupting operation, and one that is efficient enough that it could be included on chip with existing network chips or even into wireless devices. We ha...

• Type: Conference
• Year: 2005
• Where: ISCA
• Authors: Lin Tan, Timothy Sherwood
• Keywords: Hardware, Intrusion Detection, ISCA 2005, String Matching, String Matching Algorithm