A dynamically reconfigured multi-FPGA network platform for high-speed malware collection

  • Authors:
  • Sascha Mühlbach;Andreas Koch

  • Affiliations:
  • Secure Things Group, Center for Advanced Security Research Darmstadt, Darmstadt, Germany;Department of Computer Science, Embedded Systems and Applications Group, Technische Universität Darmstadt, Darmstadt, Germany

  • Venue:
  • International Journal of Reconfigurable Computing - Special issue on Selected Papers from the International Conference on Reconfigurable Computing and FPGAs (ReConFig'10)
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Malicious software has become a major threat to computer users on the Internet today. Security researchers need to gather and analyze large sample sets to develop effective countermeasures. The setting of honeypots, which emulate vulnerable applications, is one method to collect attack code. We have proposed a dedicated hardware architecture for honeypots which allows both high-speed operation at 10Gb/s and beyond and offers a high resilience against attacks on the honeypot infrastructure itself. In this work, we refine the base NetStage architecture for better management and scalability. Using dynamic partial reconfiguration, we can now update the functionality of the honeypot during operation. To allow the operation of a larger number of vulnerability emulation handlers, the initial single-device architecture is extended to scalable multichip systems. We describe the technical aspects of these modifications and show results evaluating an implementation on a current quad-FPGA reconfigurable computing platform.