Tripp, Gerald (2006) A parallel 'String Matching Engine' for use in high speed network intrusion detection systems. Journal in Computer Virology, 2 (1). pp. 21-34. ISSN 1772-9890 .
This paper describes a finite state machine approach to string matching for an intrusion detection system. To obtain high performance, we typically need to be able to operate on input data that is several bytes wide. However, finite state machine designs become more complex when operating on large input data words, partly because of needing to match the starts and ends of a string that may occur part way through an input data word. Here we use finite state machines that each operate on only a single byte wide data input. We then provide a separate finite state machine for each byte wide data path from a multi-byte wide input data word. By splitting the search strings into multiple interleaved substrings and by combining the outputs from the individual finite state machines in an appropriate way we can perform string matching in parallel across multiple finite state machines. A hardware design for a parallel string matching engine has been generated, built for implementation in a Xilinx Field Programmable Gate Array and tested by simulation. The design is capable of operating at a search rate of 4.7 Gbps with a 32-bit input word size.
|Additional information:||Article is a part of the 15th EICAR Annual Conference Proceedings|
|Uncontrolled keywords:||Security, intrusion detection, finite state machine, string matching, high speed networks|
|Subjects:||Q Science > QA Mathematics (inc Computing science) > QA 76 Software, computer programming,|
|Divisions:||Faculties > Science Technology and Medical Studies > School of Computing > Systems Architecture Group|
|Depositing User:||Mark Wheadon|
|Date Deposited:||24 Nov 2008 18:04|
|Last Modified:||06 Sep 2011 01:34|
|Resource URI:||http://kar.kent.ac.uk/id/eprint/14483 (The current URI for this page, for reference purposes)|
- Depositors only (login required):