Implementing high-speed string matching hardware for network intrusion detection systems

This paper presents high-throughput techniques for implementing FSM based string matching hardware on FPGAs. By taking advantage of the fact that string matching operations for different packets are independent, a novel multi-threading FSM design is presented, which dramatically increases the FSM frequency and the throughput of string matching operations. In addition, design techniques for high-speed interconnect and interface circuits for the proposed FSM are also presented. Experimental results conducted on FPGA platforms are presented to study the effectiveness of the proposed techniques and explore the trade-offs between system performance, strings partition granularity and hardware resource cost. Keywords Intrusion Detection System, Parallel Systems, Network Systems, FPGA-based Design, and Performance Evaluation

• Type: Conference
• Year: 2008
• Where: FPGA
• Authors: Atul Mahajan, Benfano Soewito, Sai K. Parsi, Ning Weng, Haibo Wang
• Keywords: FPGA, FPGA 2008, FSM Frequency, String Matching, Strings Partition Granularity