Tripp, Gerald (2006) A parallel 'String Matching Engine' for use in high speed network intrusion detection systems. Journal in Computer Virology, 2 (1). pp. 21-34. ISSN 1772-9890. (doi:10.1007/s11416-006-0010-4) (KAR id:14483)
PDF
Language: English |
|
Download this file (PDF/446kB) |
Preview |
Request a format suitable for use with assistive technology e.g. a screenreader | |
Official URL: http://dx.doi.org/10.1007/s11416-006-0010-4 |
Abstract
This paper describes a finite state machine approach to string matching for an intrusion detection system. To obtain high performance, we typically need to be able to operate on input data that is several bytes wide. However, finite state machine designs become more complex when operating on large input data words, partly because of needing to match the starts and ends of a string that may occur part way through an input data word. Here we use finite state machines that each operate on only a single byte wide data input. We then provide a separate finite state machine for each byte wide data path from a multi-byte wide input data word. By splitting the search strings into multiple interleaved substrings and by combining the outputs from the individual finite state machines in an appropriate way we can perform string matching in parallel across multiple finite state machines. A hardware design for a parallel string matching engine has been generated, built for implementation in a Xilinx Field Programmable Gate Array and tested by simulation. The design is capable of operating at a search rate of 4.7 Gbps with a 32-bit input word size.
Item Type: | Article |
---|---|
DOI/Identification number: | 10.1007/s11416-006-0010-4 |
Additional information: | Article is a part of the 15th EICAR Annual Conference Proceedings |
Uncontrolled keywords: | Security, intrusion detection, finite state machine, string matching, high speed networks |
Subjects: | Q Science > QA Mathematics (inc Computing science) > QA 76 Software, computer programming, |
Divisions: | Divisions > Division of Computing, Engineering and Mathematical Sciences > School of Computing |
Depositing User: | Mark Wheadon |
Date Deposited: | 24 Nov 2008 18:04 UTC |
Last Modified: | 05 Nov 2024 09:48 UTC |
Resource URI: | https://kar.kent.ac.uk/id/eprint/14483 (The current URI for this page, for reference purposes) |
- Link to SensusAccess
- Export to:
- RefWorks
- EPrints3 XML
- BibTeX
- CSV
- Depositors only (login required):