Sciweavers

AINA
2006
IEEE

Efficient Packet Matching for Gigabit Network Intrusion Detection using TCAMs

14 years 4 months ago
Efficient Packet Matching for Gigabit Network Intrusion Detection using TCAMs
Ternary content-addressable memories (TCAMs) have gained wide acceptance in the industry for storing and searching patterns in routers. But two important problems block the way to deploy TCAMs as deep package matching engines for network intrusion detection systems (NIDS): long patterns matching and range patterns matching. A novel high speed long patterns matching architecture using cascade TCAMs for large signature set based NIDS is presented in this paper. Systems to handle tens of thousands of signatures with thousands of bytes length each can be built on such architecture. A novel efficient header rules matching system is proposed in this paper. This scheme offloads the range matching task to efficient specialized comparing engines in FPGAs so that it solves the range matching problem with high throughout performance, about 250 million packets per second (Mpps) theoretically.
Ming Gao, Kenong Zhang, Jiahua Lu
Added 10 Jun 2010
Updated 10 Jun 2010
Type Conference
Year 2006
Where AINA
Authors Ming Gao, Kenong Zhang, Jiahua Lu
Comments (0)