DMCA
Deep Network Packet Filter Design for Reconfigurable Devices (2002)
| Venue: | In 12th Conference on Field Programmable Logic and Applications |
| Citations: | 16 - 2 self |
BibTeX
@INPROCEEDINGS{Cho02deepnetwork,
author = {Young H. Cho and William H. Mangione-smith},
title = {Deep Network Packet Filter Design for Reconfigurable Devices},
booktitle = {In 12th Conference on Field Programmable Logic and Applications},
year = {2002},
pages = {452--461},
publisher = {Springer-Verlag}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Most network routers and switches provide some protection against the network attacks. However, the rapidly increasing amount of damages reported over the past few years indicates the urgent need for tougher security. Deep packet inspection is one of the solutions to capture packets that can not be identified using the traditional methods. It uses a list of signatures to scan the entire content of the packet; providing the means to filter harmful packets out of the network. Since one signature does not depend on the other, the filtering process has a high degree of parallelism. Most software and hardware deep packet filters that are in use today execute the tasks under Von Neuman architecture. Such architecture can not fully take advantage of the parallelism. For instance, one of the most widely used network intrusion detection systems, Snort, configured with 845 patterns, running on a dual 1-GHz Pentium III system, can sustain a throughput of only 50 Mbps. The poor performance is due to the fact that the processor is programmed to execute several tasks sequentially instead of simultaneously. We designed scalable deep packet filters on field programmable gate arrays (FPGAs) to search for all data independent patterns simultaneously. With FPGAs, we have the ability to reprogram the filter when there are any changes to the signature set. The smallest full pattern matcher implementation for the latest Snort NIDS fits in a single 400k Xilinx FPGA (Spartan 3- XC3S400) with a sustained throughput of 1.6 Gbps. Given a larger FPGA, the design can scale linearly to support a greater number of patterns as well as higher data throughput.
Keyphrases
reconfigurable device deep network packet filter design data independent pattern filtering process past year xilinx fpga data throughput several task use today scalable deep packet filter entire content urgent need snort nids high degree harmful packet network attack network intrusion detection system network router hardware deep packet filter traditional method full pattern sustained throughput dual 1-ghz pentium iii system poor performance field programmable gate array deep packet inspection von neuman architecture
