Skip to main content

A parallel 'String Matching Engine' for use in high speed network intrusion detection systems

Tripp, Gerald (2006) A parallel 'String Matching Engine' for use in high speed network intrusion detection systems. Journal in Computer Virology, 2 (1). pp. 21-34. ISSN 1772-9890. (doi:10.1007/s11416-006-0010-4) (KAR id:14483)

Language: English
Download (274kB) Preview
[thumbnail of A_parallel_‘String_Matching_Engine’_for_use_in_high_speed_network_intrusion.pdf]
This file may not be suitable for users of assistive technology.
Request an accessible format
Official URL:


This paper describes a finite state machine approach to string matching for an intrusion detection system. To obtain high performance, we typically need to be able to operate on input data that is several bytes wide. However, finite state machine designs become more complex when operating on large input data words, partly because of needing to match the starts and ends of a string that may occur part way through an input data word. Here we use finite state machines that each operate on only a single byte wide data input. We then provide a separate finite state machine for each byte wide data path from a multi-byte wide input data word. By splitting the search strings into multiple interleaved substrings and by combining the outputs from the individual finite state machines in an appropriate way we can perform string matching in parallel across multiple finite state machines. A hardware design for a parallel string matching engine has been generated, built for implementation in a Xilinx Field Programmable Gate Array and tested by simulation. The design is capable of operating at a search rate of 4.7 Gbps with a 32-bit input word size.

Item Type: Article
DOI/Identification number: 10.1007/s11416-006-0010-4
Additional information: Article is a part of the 15th EICAR Annual Conference Proceedings
Uncontrolled keywords: Security, intrusion detection, finite state machine, string matching, high speed networks
Subjects: Q Science > QA Mathematics (inc Computing science) > QA 76 Software, computer programming,
Divisions: Divisions > Division of Computing, Engineering and Mathematical Sciences > School of Computing
Depositing User: Mark Wheadon
Date Deposited: 24 Nov 2008 18:04 UTC
Last Modified: 16 Nov 2021 09:52 UTC
Resource URI: (The current URI for this page, for reference purposes)
  • Depositors only (login required):


Downloads per month over past year