FPGA-based cuckoo hashing for pattern matching in NIDS/NIPS

Authors:
Thinh Ngoc Tran;Surin Kittitornkun
Affiliations:
Dept.of Computer Engineering, Faculty of Engineering, King Mongkut's Institute of Technology Ladkrabang, Bangkok, Thailand;Dept.of Computer Engineering, Faculty of Engineering, King Mongkut's Institute of Technology Ladkrabang, Bangkok, Thailand
Venue:
APNOMS'07 Proceedings of the 10th Asia-Pacific conference on Network Operations and Management Symposium: managing next generation networks and services
Year:
2007

Citing 7
Cited 2

Performance in Practice of String Hashing Functions

Proceedings of the Fifth International Conference on Database Systems for Advanced Applications (DASFAA)
Implementation of a Content-Scanning Module for an Internet Firewall

FCCM '03 Proceedings of the 11th Annual IEEE Symposium on Field-Programmable Custom Computing Machines
Cuckoo hashing

Journal of Algorithms
Scalable Pattern Matching for High Speed Networks

FCCM '04 Proceedings of the 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines
Pre-Decoded CAMs for Efficient and High-Speed NIDS Pattern Matching

FCCM '04 Proceedings of the 12th Annual IEEE Symposium on Field-Programmable Custom Computing Machines
Fast Reconfiguring Deep Packet Filter for 1+ Gigabit Network

FCCM '05 Proceedings of the 13th Annual IEEE Symposium on Field-Programmable Custom Computing Machines
On universal classes of fast high performance hash functions, their time-space tradeoff, and their applications

SFCS '89 Proceedings of the 30th Annual Symposium on Foundations of Computer Science

A precise analysis of Cuckoo hashing

ACM Transactions on Algorithms (TALG)
String alignment pre-detection using unique subsequences for FPGA-based network intrusion detection

Computer Communications

Quantified Score

Hi-index	0.00

Visualization

Abstract

Pattern matching for network intrusion/prevention detection demands exceptionally high throughput with recent updates to support new attack patterns. This paper describes a novel FPGA-based pattern matching architecture using a recent hashing algorithm called Cuckoo Hashing. The proposed architecture features on-the-fly pattern updates without reconfiguration, more efficient hardware utilization, and higher throughput. Through various algorithmic changes of Cuckoo Hashing, we can implement parallel pattern matching on SRAM-based FPGA. Our system can accommodate the newest Snort rule-set, an open source Network Intrusion Detection/Prevention System, and achieve the highest utilization in terms of SRAM per character and Logic Cells per character at 15.63 bits/character and 0.033 Logic Cells/character, respectively on major Xilinx Virtex FPGA architectures. Compared to others, ours is more efficient than any other Xilinx FPGA architectures.