A Survey of the High-Speed Self-learning Intrusion Detection Research Area
AIMS '07 Proceedings of the 1st international conference on Autonomous Infrastructure, Management and Security: Inter-Domain Management
An independently partial pattern matching for content inspection at multi gigabit networks
ICACT'10 Proceedings of the 12th international conference on Advanced communication technology
| Hi-index | 0.00 |
Ternary content-addressable memories (TCAMs) have gained wide acceptance in the industry for storing and searching patterns in routers. But two important problems block the way to deploy TCAMs as deep package matching engines for network intrusion detection systems (NIDS): long patterns matching and range patterns matching. A novel high speed long patterns matching architecture using cascade TCAMs for large signature set based NIDS is presented in this paper. Systems to handle tens of thousands of signatures with thousands of bytes length each can be built on such architecture. A novel efficient header rules matching system is proposed in this paper. This scheme offloads the range matching task to efficient specialized comparing engines in FPGAs so that it solves the range matching problem with high throughout performance, about 250 million packets per second (Mpps) theoretically.