A Signature Match Processor Architecture for Network Intrusion Detection

In this paper, we introduce a novel architecture for a hardware based network intrusion detection system (NIDS). NIDSs are becoming critical components of the network infrastructure as they serve as a key line of defense in network protection. However, current methods are much too compute intensive and can not begin to meet the bandwidth requirements of a moderate sized corporate network. Thus, hardware techniques are desired to speed up network processing. This paper introduces a FPGA based signature match processor that can serve as the core of a hardware based NIDS. The signature match processor’s key feature is a CAM-based cellular processor architecture that can match strings in an area efficient manner. Using a unique binary tree structure, we are also able to generate priority encoded addresses corresponding to multiple signature matches.

• Type: Conference
• Year: 2005
• Where: FCCM
• Authors: Janardhan Singaraju, Long Bu, John A. Chandy
• Keywords: FCCM 2005, Hardware, Hardware Based Network, Hardware Based Nids, Signature Match Processor