A Framework for Rule Processing in Reconfigurable Network Systems
|
|
|
- Emery Patterson
- 5 years ago
- Views:
Transcription
1 A Framework for Rule Processing in Reconfigurable Network Systems Michael Attig and John Lockwood Washington University in Saint Louis Applied Research Laboratory Department of Computer Science and Engineering May 1, 2005 Rule Processing Framework FCCM Outline Overview Background Architecture Results Summary Rule Processing Framework FCCM
2 Rule Processing Overview Rule processing & intrusion detection TCP Flow Processing Header Processing Payload Scanning alert tcp any 110 any any (msg:"virus - Possible MyRomeo Worm"; flow:established; content:"myromeo.exe"; nocase; classtype:miscactivity; sid:723; rev:6;) Snort Rules (version 2.2 Sept 2004) 2464 Rules 292 Headers 2107 Signatures 233 Regular Expressions Rule Processing Framework FCCM Rule Characteristics 2464 unique rules 292 unique header rules 168 are header-only 2107 unique signatures 97% less than 32 bytes Spread across 2296 of rules 233 regular expressions Snort rules always contain static signature also Few signatures associated with many rules 83% found in single rule Only 18 associated with more than 10 rules 10 header rules can match at once (pessimistic) Number of occurrences Number of Occurrences Unique Signature Distribution Signature Length (bytes) Unique Signature Occurences signature number Snort version 2.2 (Sept 2004) Rule Processing Framework FCCM
3 Fully Functional Rule Processing String Matching? Comparators [Sourdis fccm 04] Partitioning [Baker fccm 04]? TCAMs [Yu hoti 04]? Bloom Filters [Attig fccm 04]? DFAs [Moscola fccm 03] Header Classification Complete Rule Processing NFAs [Clark fccm 04] BV-TCAM [Song fpga 05]? TCP Flow? Reconstruction [Schuehler fpl 04] Rule Processor Pipelining [Cho fccm 04] Rule Processing Framework FCCM Rule Processing Framework Overview Order TCP flows for inspection by payload scanner(s) h header modules determine matching header rules Local Area Area Network p payload modules search for static signatures and regular expressions Rule processor uses header and payload match criteria to determine rule matches TCP/IP Data Intrusion Detection System Local Local Area Area Network Network Intrusion Detection System Internet Matching header and string IDs sent to rule processor using standard interface Focus of this Talk Internet Internet Rule Processing Framework FCCM
4 Rule Processor FPGA (1) (2) (3) (5) (6) (7) Software Communication Wrapper Matching Criteria Communication Wrapper Rule Processing Framework FCCM Example R1: Alert tcp any 80 any 125 (content: string1 ; content: string2 ;) Algorithmically: R1: H1 Λ C1 Λ C2 Rule Processing Framework FCCM
5 Rule Processing Example TCP/IP Data flow H1 C1C2 Rule Processing Framework FCCM Rule Processor FPGA (1) (2) (3) (5) (6) (7) Software Communication Wrapper flow H1 C1 C2 C1 X R1 H1 Headers Reset Rule Header +1 Matching Criteria Communication Wrapper Rule Processing Framework FCCM
6 Implementation Environment Xilinx Virtex 2000E FPGA 12% LUTs 25% Slices 93% of Block RAMs 80.6 MHz Stacked configuration allows chaining processing Rule Processing Framework FCCM Worst Case Throughput Worst case when signature associated with many rules detected Only 18 signatures in more than 10 rules Worst case signature in 135 rules Scenario: Back-to-back 44 byte TCP packets from different flows and as payload Worst case assumes 7 million attack packets per second Throughput (Mbps) Framework Throughput Packet Size (Bytes) Worst-case Average Case Rule Processing Framework FCCM
7 Intrusion Detection of WashU s Backbone Network Matching 4 Byte Signatures Matching 12+ Byte Signatures Observe ~10,000 total string matches per second on WashU s backbone network (~ Mbps) Scaling to 2.5 Gbps, only ~100,000 string matches per second Rule Processing Framework FCCM Next Generation FPGA Projections More block RAM Faster place & route Parallel copies of pipeline Multiple IDs per clock cycle QDR SRAMs Rule Processor Relative Improvement 6x improvement to throughput Rule Frequency Throughput VirtexE Virtex2 Virtex4 Rule Processing Framework FCCM
8 Related Work Function Group and Component Device Logic Cells Throughput (Gbps) Flow GaTech Stream Assembler Virtex (10%) 3.2 Monitoring Northwestern U. Flow Monitor Virtex WashU TCP Processor Virtex ,100 (35%) 10.3 Header Processing WashU BV-TCAM Virtex ,200 (10%) 10 Payload Crete Pre-decoded CAMs Virtex ,268 (95%) 9.7 Scanning GaTech Decoder Trees Virtex ,890 (81%) 7 Tokyo Trie-based Hash Virtex ,365 (7%) 10 UCLA Packet Filters Spartan ,202 (37%) 3.2 USC Partitioning Virtex2 Pro 15,010 (15%) 4.5 WashU Bloom Filters Virtex ,850 (85%) 20.4 Correlation WashU Rule Processor Virtex ,200 (95%) 15.9 Rule Processing Framework FCCM Contributions Development of large-scale Rule Processing Framework Bridge between component processing and rule processing Supports up to 32,768 rules Rule processing framework capable of 2.5 Gbps throughput on FPX Projected to 15.9 on latest Virtex 4 Rule processor operated on TCP flows Context information stored for over 2 million simultaneous flows Rule Processing Framework FCCM
9 Acknowledgments Research Sponsors Global Velocity Boeing ARL Faculty & Students Rule Processing Framework FCCM Questions? Rule Processing Framework FCCM
10 Communication Wrapper Interface Between Devices Between Software/Hardware Rule Processing Framework FCCM Example R1: Alert tcp any 80 any 125 (content: string1 ; content: string2 ;) R2: Alert tcp any 8080 any 1024 (content: string1 ;) R1: H1 Λ C1 Λ C2 R2: H2 Λ C1 Rule Processing Framework FCCM
11 Rule Processor FPGA Communication Wrapper H1 C1 C2 C1 CIDs CIDs RIDs R1 H2 H1 X R2 Reset X BRAM +1 Communication Wrapper Rule Processing Framework FCCM Adding Modules Accept and act upon IP packets Communicate match criteria using communication wrapper interface Provide deterministic interfaces Abstract transport protocol Software Configuration using communication wrapper Represent matching criteria as ID numbers Allows combination of techniques Take advantage of best characteristics General classifiers vs. field-specific headers Static strings vs. regular expressions Rule Processing Framework FCCM
12 Evaluation Recall Rule IDs are inserted into pipeline based on matching signatures Throughput (Mbps) Throughput versus Rule Look-ups per Second 0 1.E+00 1.E+02 1.E+04 1.E+06 1.E Million rule IDs per second Rule Look-ups per Second Rule Processing Framework FCCM Additional Rules Supported Virtex of 144 Block RAMs (18 Kbits each) 2 copies of pipeline 10 BRAM in stage 2 10 BRAM in stage 5 40 BRAM in stage 6 184,320 rules supported Virtex of 240 Block RAMs (18 Kbits each) 4 copies of pipeline 9 BRAM in stage 2 9 BRAM in stage 5 36 BRAM in stage 6 165,888 rules supported Rule Processing Framework FCCM
A Framework for Rule Processing in Reconfigurable Network Systems
A Framework for Rule Processing in Reconfigurable Network Systems Michael Attig and John Lockwood Department of Computer Science and Engineering Washington University Saint Louis, MO 63130 E-mail: {mea1,
A Framework for Rule Processing in Reconfigurable Network Systems
A Framework for Rule Processing in Reconfigurable Network Systems Michael Attig and John Lockwood Department of Computer Science and Engineering Washington University Saint Louis, MO 63130 E-mail: {mea1,
A Modular System for FPGA-Based TCP Flow Processing in High-Speed Networks
A Modular System for FPGA-Based Flow Processing in High-Speed Networks David V. Schuehler and John W. Lockwood Applied Research Laboratory, Washington University One Brookings Drive, Campus Box 1045 St.
TCP-Splitter: A Reconfigurable Hardware Based TCP/IP Flow Monitor
CP-Splitter: A Reconfigurable Hardware Based CP/IP Flow Monitor David V. Schuehler dvs1@arl.wustl.edu John W. Lockwood lockwood@arl.wustl.edu Applied Research Laboratory (ARL) Department of Computer Science
Internet Worm and Virus Protection for Very High-Speed Networks
Internet Worm and Virus Protection for Very High-Speed Networks John W. Lockwood Professor of Computer Science and Engineering lockwood@arl.wustl.edu http://www.arl.wustl.edu/~lockwood Research Sponsor:
Automatic compilation framework for Bloom filter based intrusion detection
Automatic compilation framework for Bloom filter based intrusion detection Dinesh C Suresh, Zhi Guo*, Betul Buyukkurt and Walid A. Najjar Department of Computer Science and Engineering *Department of Electrical
Efficient Packet Classification for Network Intrusion Detection using FPGA
Efficient Packet Classification for Network Intrusion Detection using FPGA ABSTRACT Haoyu Song Department of CSE Washington University St. Louis, USA hs@arl.wustl.edu FPGA technology has become widely
Multi-pattern Signature Matching for Hardware Network Intrusion Detection Systems
This full text paper was peer reviewed at the direction of IEEE Communications Society subject matter experts for publication in the IEEE GLOBECOM 5 proceedings. Multi-pattern Signature Matching for Hardware
Configurable String Matching Hardware for Speeding up Intrusion Detection
Configurable String Matching Hardware for Speeding up Intrusion Detection Monther Aldwairi, Thomas Conte, Paul Franzon Dec 6, 2004 North Carolina State University {mmaldwai, conte, paulf}@ncsu.edu www.ece.ncsu.edu/erl
TriBiCa: Trie Bitmap Content Analyzer for High-Speed Network Intrusion Detection
Dept. of Electrical and Computer Eng. : Trie Bitmap Content Analyzer for High-Speed Network Intrusion Detection N. Sertac Artan and Jonathan H. Chao 8 May 27 26th Annual IEEE Conference on Computer Communications
Architectures for Rule Processing Intrusion Detection and Prevention Systems
Washington University in St. Louis Washington University Open Scholarship All Computer Science and Engineering Research Computer Science and Engineering Report Number: WUCSE-2005-18 2005-05-01 Architectures
NETWORK INTRUSION DETECTION SYSTEMS ON FPGAS WITH ON-CHIP NETWORK INTERFACES
In Proceedings of International Workshop on Applied Reconfigurable Computing (ARC), Algarve, Portugal, February 2005. NETWORK INTRUSION DETECTION SYSTEMS ON FPGAS WITH ON-CHIP NETWORK INTERFACES Christopher
Fast Reconfiguring Deep Packet Filter for 1+ Gigabit Network
Fast Reconfiguring Deep Packet Filter for + Gigabit Network Young H. Cho and William H. Mangione-Smith {young,billms}@ee.ucla.edu University of California, Los Angeles Department of Electrical Engineering
Automated Incremental Design of Flexible Intrusion Detection Systems on FPGAs 1
Automated Incremental Design of Flexible Intrusion Detection Systems on FPGAs 1 Zachary K. Baker and Viktor K. Prasanna University of Southern California, Los Angeles, CA, USA zbaker@halcyon.usc.edu, prasanna@ganges.usc.edu
Highly Space Efficient Counters for Perl Compatible Regular Expressions in FPGAs
Highly Space Efficient Counters for Perl Compatible Regular Expressions in FPGAs Chia-Tien Dan Lo and Yi-Gang Tai Department of Computer Science University of Texas at San Antonio {danlo,ytai}@cs.utsa.edu
Boundary Hash for Memory-Efficient Deep Packet Inspection
Boundary Hash for Memory-Efficient Deep Packet Inspection N. Sertac Artan, Masanori Bando, and H. Jonathan Chao Electrical and Computer Engineering Department Polytechnic University Brooklyn, NY Abstract
VARIABLE-LENGTH HASHING FOR EXACT PATTERN MATCHING
VARIABLE-LENGTH HASHING FOR EXACT PATTERN MATCHING Dionisios Pnevmatikatos Foundation for Research and Technology-Hellas Institute of Computer Science Vasilika Vouton, Heraklion, Greece pnevmati@ics.forth.gr
Novel FPGA-Based Signature Matching for Deep Packet Inspection
Novel FPGA-Based Signature Matching for Deep Packet Inspection Nitesh B. Guinde and Sotirios G. Ziavras Electrical & Computer Engineering Department, New Jersey Institute of Technology, Newark NJ 07102,
Extensible Network Configuration and Communication Framework
Extensible Network Configuration and Communication Framework Todd Sproull and John Lockwood Applied Research Laboratory Department of Computer Science and Engineering: Washington University in Saint Louis
AN FPGA BASED ARCHITECTURE FOR COMPLEX RULE MATCHING WITH STATEFUL INSPECTION OF MULTIPLE TCP CONNECTIONS
AN FPGA BASED ARCHITECTURE FOR COMPLEX RULE MATCHING WITH STATEFUL INSPECTION OF MULTIPLE TCP CONNECTIONS Claudio Greco, Enrico Nobile, Salvatore Pontarelli, Simone Teofili CNIT/University of Rome Tor
A parallel String Matching Engine for use in high speed network intrusion detection systems.
A parallel String Matching Engine for use in high speed network intrusion detection systems. About Author Gerald Tripp University of Kent Gerald Tripp is a Lecturer in Computer Science at the University
Automatic Synthesis of Efficient Intrusion Detection Systems on FPGAs 1
Automatic Synthesis of Efficient Intrusion Detection Systems on FPGAs 1 Zachary K. Baker and Viktor K. Prasanna zbaker@usc.edu, prasanna@ganges.usc.edu Abstract This paper presents a methodology and a
Packet Inspection on Programmable Hardware
Abstract Packet Inspection on Programmable Hardware Benfano Soewito Information Technology Department, Bakrie University, Jakarta, Indonesia E-mail: benfano.soewito@bakrie.ac.id In the network security
speed and low area matching advantages of high speed and parallel processing [6]. It can
![speed and low area matching advantages of high speed and parallel processing [6]. It can](/thumbs/74/71014170.jpg "speed and low area matching advantages of high speed and parallel processing [6]. It can")
227886165 FPGA I based High speed and low area matching cost pattern Jian Huang, Zongkai Yang, Xu Du, and Wei Liu Department of Electronic and Information Engineering, Huazhong University of Science and
RiceNIC. Prototyping Network Interfaces. Jeffrey Shafer Scott Rixner
RiceNIC Prototyping Network Interfaces Jeffrey Shafer Scott Rixner RiceNIC Overview Gigabit Ethernet Network Interface Card RiceNIC - Prototyping Network Interfaces 2 RiceNIC Overview Reconfigurable and
Highly Memory-Efficient LogLog Hash for Deep Packet Inspection
Highly Memory-Efficient LogLog Hash for Deep Packet Inspection Masanori Bando, N. Sertac Artan, and H. Jonathan Chao Department of Electrical and Computer Engineering Polytechnic Institute of NYU Abstract
SEVER INSTITUTE OF TECHNOLOGY MASTER OF SCIENCE DEGREE THESIS ACCEPTANCE. (To be the first page of each copy of the thesis)
SEVER INSTITUTE OF TECHNOLOGY MASTER OF SCIENCE DEGREE THESIS ACCEPTANCE (To be the first page of each copy of the thesis) DATE: July 29, 2003 STUDENT S NAME: James Moscola This student s thesis, entitled
A Methodology for Synthesis of Efficient Intrusion Detection Systems on FPGAs 1
A Methodology for Synthesis of Efficient Intrusion Detection Systems on FPGAs 1 Zachary K. Baker and Viktor K. Prasanna University of Southern California, Los Angeles, CA, USA zbaker@halcyon.usc.edu, prasanna@ganges.usc.edu
FPgrep and FPsed: Packet Payload Processors for Managing the Flow of Digital Content on Local Area Networks and the Internet
Washington University in St. Louis Washington University Open Scholarship All Computer Science and Engineering Research Computer Science and Engineering Report Number: WUCSE-2003-56 2003-07-29 FPgrep and
Packet Header Analysis and Field Extraction for Multigigabit Networks
Packet Header Analysis and Field Extraction for Multigigabit Networks Petr Kobierský Faculty of Information Technology Brno University of Technology Božetěchova 2, 612 66, Brno, Czech Republic Email: ikobier@fit.vutbr.cz
FPGA based Network Traffic Analysis using Traffic Dispersion Graphs
FPGA based Network Traffic Analysis using Traffic Dispersion Graphs 2 nd September, 2010 Faisal N. Khan, P. O. Box 808, Livermore, CA 94551 This work performed under the auspices of the U.S. Department
CPE/EE 422/522. Introduction to Xilinx Virtex Field-Programmable Gate Arrays Devices. Dr. Rhonda Kay Gaede UAH. Outline
CPE/EE 422/522 Introduction to Xilinx Virtex Field-Programmable Gate Arrays Devices Dr. Rhonda Kay Gaede UAH Outline Introduction Field-Programmable Gate Arrays Virtex Virtex-E, Virtex-II, and Virtex-II
Performance of FPGA Implementation of Bit-split Architecture for Intrusion Detection Systems
Performance of FPGA Implementation of Bit-split Architecture for Intrusion Detection Systems Hong-Jip Jung, Zachary K. Baker and Viktor K. Prasanna University of Southern California, Los Angeles, CA, USA
Project Proposal. ECE 526 Spring Modified Data Structure of Aho-Corasick. Benfano Soewito, Ed Flanigan and John Pangrazio
Project Proposal ECE 526 Spring 2006 Modified Data Structure of Aho-Corasick Benfano Soewito, Ed Flanigan and John Pangrazio 1. Introduction The internet becomes the most important tool in this decade
HIGH SPEED DOCUMENT CLUSTERING IN RECONFIGURABLE HARDWARE. G. Adam Covington, Charles L.G. Comstock, Andrew A. Levine, John W. Lockwood, Young H.
HIGH SPEED DOCUMENT CLUSTERING IN RECONFIGURABLE HARDWARE G. Adam Covington, Charles L.G. Comstock, Andrew A. Levine, John W. Lockwood, Young H. Cho Applied Research Laboratory, Washington University One
Decision Forest: A Scalable Architecture for Flexible Flow Matching on FPGA
Decision Forest: A Scalable Architecture for Flexible Flow Matching on FPGA Weirong Jiang, Viktor K. Prasanna University of Southern California Norio Yamagaki NEC Corporation September 1, 2010 Outline
Regular expression matching with input compression: a hardware design for use within network intrusion detection systems.
Regular expression matching with input compression: a hardware design for use within network intrusion detection systems. Gerald Tripp University of Kent About Author Gerald Tripp is a Lecturer in Computer
TCP-Splitter: Design, Implementation and Operation
Washington University in St. Louis Washington University Open Scholarship All Computer Science and Engineering Research Computer Science and Engineering Report Number: WUCSE-2003-14 2003-03-18 TCP-Splitter:
TriBiCa: Trie Bitmap Content Analyzer for High-Speed Network Intrusion Detection
TriBiCa: Trie Bitmap Content Analyzer for High-Speed Network Intrusion Detection N. Sertac Artan ECE Department Polytechnic University Brooklyn, NY (sartan01@utopia.poly.edu) H. Jonathan Chao ECE Department
INTERNET CONTENT SEARCH USING FPGA S
INTERNET CONTENT SEARCH USING FPGA S Inan Aydin 1, Ali Ziya Alkar 2 1 Karel A.Ş., Ankara, Turkey, inan.aydin@karel.com.tr 2 Hacettepe University, Department of Electrical Eng, Beytepe, Ankara, Turkey,
Jakub Cabal et al. CESNET
CONFIGURABLE FPGA PACKET PARSER FOR TERABIT NETWORKS WITH GUARANTEED WIRE- SPEED THROUGHPUT Jakub Cabal et al. CESNET 2018/02/27 FPGA, Monterey, USA Packet parsing INTRODUCTION It is among basic operations
Regular expression matching with input compression: a hardware design for use within network intrusion detection systems
J Comput Virol (27) 3:125 134 DOI 1.17/s11416-7-47-z EICAR 27 BEST ACADEMIC PAPERS Regular expression matching with input compression: a hardware design for use within network intrusion detection systems
HAIL: A HARDWARE-ACCELERATED ALGORITHM FOR LANGUAGE IDENTIFICATION. Charles M. Kastner, G. Adam Covington, Andrew A. Levine, John W.
HAIL: A HARDWARE-ACCELERATED ALGORITHM FOR LANGUAGE IDENTIFICATION Charles M. Kastner, G. Adam Covington, Andrew A. Levine, John W. Lockwood Applied Research Laboratory Washington University in St. Louis
Scrypt ASIC Prototyping Preliminary Design Document
Scrypt ASIC Prototyping Preliminary Design Document 1/13 Revision History Version Date Author Remarks Approved by v0.1 2/13 Contents 1 Scrypt Algorithm... 5 2 Major blocks in a Scrypt core... 6 3 Internal
An Efficient FPGA Implementation of Principle Component Analysis based Network Intrusion Detection System
An Efficient FPGA Implementation of Principle Component Analysis based Network Intrusion Detection System Abhishek Das Sanchit Misra Sumeet Joshi Joseph Zambreno Gokhan Memik Alok Choudhary Electrical
Hash-Based String Matching Algorithm For Network Intrusion Prevention systems (NIPS)
Hash-Based String Matching Algorithm For Network Intrusion Prevention systems (NIPS) VINOD. O & B. M. SAGAR ISE Department, R.V.College of Engineering, Bangalore-560059, INDIA Email Id :vinod.goutham@gmail.com,sagar.bm@gmail.com
Large-scale Multi-flow Regular Expression Matching on FPGA*
212 IEEE 13th International Conference on High Performance Switching and Routing Large-scale Multi-flow Regular Expression Matching on FPGA* Yun Qu Ming Hsieh Dept. of Electrical Eng. University of Southern
FPGA Implementation of Token-Based Clam AV Regex Virus Signatures with Early Detection
IOSR Journal of Electronics and Communication Engineering (IOSR-JECE) e-issn: 2278-2834,p- ISSN: 2278-8735 PP 54-61 www.iosrjournals.org FPGA Implementation of Token-Based Clam AV Regex Virus Signatures
Dynamic Pipelining: Making IP- Lookup Truly Scalable
Dynamic Pipelining: Making IP- Lookup Truly Scalable Jahangir Hasan T. N. Vijaykumar School of Electrical and Computer Engineering, Purdue University SIGCOMM 05 Rung-Bo-Su 10/26/05 1 0.Abstract IP-lookup
FPGA-Based Intrusion Detection System for 10 Gigabit Ethernet
IEICE TRANS. INF. & SYST., VOL.E90 D, NO.12 DECEMBER 2007 1923 PAPER Special Section on Reconfigurable Systems FPGA-Based Intrusion Detection System for 10 Gigabit Ethernet Toshihiro KATASHITA a), Yoshinori
Project Proposal. ECE 526 Spring Modified Data Structure of Aho-Corasick. Benfano Soewito, Ed Flanigan and John Pangrazio
Project Proposal ECE 526 Spring 2006 Modified Data Structure of Aho-Corasick Benfano Soewito, Ed Flanigan and John Pangrazio 1. Introduction The internet becomes the most important tool in this decade
Regular Expression Acceleration at Multiple Tens of Gb/s
Regular Expression Acceleration at Multiple Tens of Gb/s Jan van Lunteren, Jon Rohrer, Kubilay Atasu, Christoph Hagleitner IBM Research, Zurich Research Laboratory 8803 Rüschlikon, Switzerland email: jvl@zurich.ibm.com
Hardware Implementation for Scalable Lookahead Regular Expression Detection
Hardware Implementation for Scalable Lookahead Regular Expression Detection Masanori Bando, N. Sertac Artan, Nishit Mehta, Yi Guan, and H. Jonathan Chao Department of Electrical and Computer Engineering
Deep Packet Inspection for Intrusion Detection Systems: A Survey
Deep Packet Inspection for Intrusion Detection Systems: A Survey Tamer AbuHmed, Abedelaziz Mohaisen, and DaeHun Nyang Information Security Research Laboratory, Inha University, Incheon 42-75, Korea tamer@seclab.inha.ac.kr,
Hardware Acceleration in Computer Networks. Jan Kořenek Conference IT4Innovations, Ostrava
Hardware Acceleration in Computer Networks Outline Motivation for hardware acceleration Longest prefix matching using FPGA Hardware acceleration of time critical operations Framework and applications Contracted
Automation Framework for Large-Scale Regular Expression Matching on FPGA. Thilan Ganegedara, Yi-Hua E. Yang, Viktor K. Prasanna
Automation Framework for Large-Scale Regular Expression Matching on FPGA Thilan Ganegedara, Yi-Hua E. Yang, Viktor K. Prasanna Ming-Hsieh Department of Electrical Engineering University of Southern California
TOKEN-BASED DICTIONARY PATTERN MATCHING FOR TEXT ANALYTICS. Raphael Polig, Kubilay Atasu, Christoph Hagleitner
TOKEN-BASED DICTIONARY PATTERN MATCHING FOR TEXT ANALYTICS Raphael Polig, Kubilay Atasu, Christoph Hagleitner IBM Research - Zurich Rueschlikon, Switzerland email: pol, kat, hle@zurich.ibm.com ABSTRACT
Design and Implementation of DPI Mechanism for NIDS on FPGA
Design and Implementation of DPI Mechanism for NIDS on FPGA Veena M P 1, Divya Prabha 2, Dr. M Z Kurian 3 M.Tech [Digital electronics], Sri Siddhartha Institute of Technology, Tumkur, Karnataka, India
TCP Programmer for FPXs
TCP Programmer for s Harvey Ku John W. Lockwood David V. Schuehler Department of Computer Science Applied Research Lab Washington University 1 Brookings Drive, Box 1045 Saint Louis, MO 63130 WUCS-2002-29
REGULAR expressions are widely used in the network intrusion
IEEE TRANSACTIONS ON VERY LARGE SCALE INTEGRATION (VLSI) SYSTEMS, VOL. 15, NO. 12, DECEMBER 2007 1303 Optimization of Pattern Matching Circuits for Regular Expression on FPGA Cheng-Hung Lin, Student Member,
SCALABLE HIGH-THROUGHPUT SRAM-BASED ARCHITECTURE FOR IP-LOOKUP USING FPGA. Hoang Le, Weirong Jiang, Viktor K. Prasanna
SCALABLE HIGH-THROUGHPUT SRAM-BASED ARCHITECTURE FOR IP-LOOKUP USING FPGA Hoang Le, Weirong Jiang, Viktor K. Prasanna Ming Hsieh Department of Electrical Engineering University of Southern California Los
Regular Expression Matching for Reconfigurable Packet Inspection
Regular Expression Matching for Reconfigurable Packet Inspection João Bispo, Ioannis Sourdis #,João M.P. Cardoso and Stamatis Vassiliadis # # Computer Engineering, TU Delft, The Netherlands, {sourdis,
FPX Architecture for a Dynamically Extensible Router
FPX Architecture for a Dynamically Extensible Router Alex Chandra, Yuhua Chen, John Lockwood, Sarang Dharmapurikar, Wenjing Tang, David Taylor, Jon Turner http://www.arl.wustl.edu/arl Dynamically Extensible
Pipelined Parallel AC-based Approach for Multi-String Matching
2008 14th IEEE International Conference on Parallel and Distributed Systems Pipelined Parallel AC-based Approach for Multi-String Matching Wei Lin 1, 2, Bin Liu 1 1 Department of Computer Science and Technology,
An Architecture for IPv6 Lookup Using Parallel Index Generation Units
An Architecture for IPv6 Lookup Using Parallel Index Generation Units Hiroki Nakahara, Tsutomu Sasao, and Munehiro Matsuura Kagoshima University, Japan Kyushu Institute of Technology, Japan Abstract. This
Resource-Efficient SRAM-based Ternary Content Addressable Memory
Abstract: Resource-Efficient SRAM-based Ternary Content Addressable Memory Static random access memory (SRAM)-based ternary content addressable memory (TCAM) offers TCAM functionality by emulating it with
Protocol Processing on the FPX
Field-programmable Port Extender (FPX) January 2002 Workshop Protocol Processing on the FPX John Lockwood, Lockwood@arl.wustl.edu Assistant Professor Washington University Department of Computer Science
Scalable Automaton Matching for High-speed Deep Content Inspection
Scalable Automaton Matching for High-speed Deep Content Inspection Ying-Dar Lin, Kuo-Kun Tseng and Chen-Chou Hung National Chiao Tung University, Taiwan {ydlin@cis, kktseng@cis and bry@cis} nctuedutw Yuan-Cheng
CprE 583 Reconfigurable Computing
CprE / ComS 583 Reconfigurable Computing Prof. Joseph Zambreno Department of Electrical and Computer Engineering Iowa State University Lecture #9 Logic Emulation Technology Recap FPGA-Based Router (FPX)
Switch and Router Design. Packet Processing Examples. Packet Processing Examples. Packet Processing Rate 12/14/2011
// Bottlenecks Memory, memory, 88 - Switch and Router Design Dr. David Hay Ross 8b dhay@cs.huji.ac.il Source: Nick Mckeown, Isaac Keslassy Packet Processing Examples Address Lookup (IP/Ethernet) Where
Two-Stage Decomposition of SNORT Rules towards Efficient Hardware Implementation
Two-Stage Decomposition of SNORT Rules towards Efficient Hardware Implementation Hao Chen, Douglas H. Summerville, Yu Chen* Dept. of Electrical and Computer Engineering, SUNY Binghamton, Binghamton, NY
Efficient Packet Classification on FPGAs also Targeting at Manageable Memory Consumption
Efficient Packet Classification on FPGAs also Targeting at Manageable Memory Consumption Nitesh Guinde, Sotirios G. Ziavras and Roberto Rojas-Cessa Department of Electrical and Computer Engineering New
LegUp: Accelerating Memcached on Cloud FPGAs
0 LegUp: Accelerating Memcached on Cloud FPGAs Xilinx Developer Forum December 10, 2018 Andrew Canis & Ruolong Lian LegUp Computing Inc. 1 COMPUTE IS BECOMING SPECIALIZED 1 GPU Nvidia graphics cards are
Efficient String Matching FPGA for speed up Network Intrusion Detection
Appl. Math. Inf. Sci. 12, No. 2, 397-404 (2018) 397 Applied Mathematics & Information Sciences An International Journal http://dx.doi.org/10.18576/amis/120214 Efficient String Matching FPGA for speed up
FPGA Based Packet Classification Using Multi-Pipeline Architecture
International Journal of Wireless Communications and Mobile Computing 2015; 3(3): 27-32 Published online May 8, 2015 (http://www.sciencepublishinggroup.com/j/wcmc) doi: 10.11648/j.wcmc.20150303.11 ISSN:
High Capacity and High Performance 20nm FPGAs. Steve Young, Dinesh Gaitonde August Copyright 2014 Xilinx
High Capacity and High Performance 20nm FPGAs Steve Young, Dinesh Gaitonde August 2014 Not a Complete Product Overview Page 2 Outline Page 3 Petabytes per month Increasing Bandwidth Global IP Traffic Growth
A Passive Network Appliance for Real-Time Network Monitoring
A Passive Network Appliance for Real-Time Network Monitoring Michael J Schultz, Ben Wun, and Patrick Crowley Applied Research Laboratory Washington University in Saint Louis This material is based upon
Hardware Laboratory Configuration
Field-programmable Port Extender () January 2002 Workshop Hardware Laboratory Configuration John Lockwood, Lockwood@arl.wustl.edu Assistant Professor Washington University Department of Computer Science
HIGH-PERFORMANCE PACKET PROCESSING ENGINES USING SET-ASSOCIATIVE MEMORY ARCHITECTURES
HIGH-PERFORMANCE PACKET PROCESSING ENGINES USING SET-ASSOCIATIVE MEMORY ARCHITECTURES by Michel Hanna B.S., Cairo University at Fayoum, 1999 M.S., Cairo University, 2004 M.S., University of Pittsburgh,
Towards High-performance Flow-level level Packet Processing on Multi-core Network Processors
Towards High-performance Flow-level level Packet Processing on Multi-core Network Processors Yaxuan Qi (presenter), Bo Xu, Fei He, Baohua Yang, Jianming Yu and Jun Li ANCS 2007, Orlando, USA Outline Introduction
Low Latency FPGA Acceleration of Market Data Feed Arbitration
Low Latency FPGA Acceleration of Market Data Feed Arbitration Stewart Denholm, Hiroaki Inoue, Takashi Takenaka, Tobias Becker and Wayne Luk Department of Computing, Imperial College London, London, UK
Supra-linear Packet Processing Performance with Intel Multi-core Processors
White Paper Dual-Core Intel Xeon Processor LV 2.0 GHz Communications and Networking Applications Supra-linear Packet Processing Performance with Intel Multi-core Processors 1 Executive Summary Advances
PowerPC on NetFPGA CSE 237B. Erik Rubow
PowerPC on NetFPGA CSE 237B Erik Rubow NetFPGA PCI card + FPGA + 4 GbE ports FPGA (Virtex II Pro) has 2 PowerPC hard cores Untapped resource within NetFPGA community Goals Evaluate performance of on chip
Liquid Architecture Λ
Liquid Architecture Λ Phillip Jones, Shobana Padmanabhan, Daniel Rymarz, John Maschmeyer David V. Schuehler, John W. Lockwood, and Ron K. Cytron Department of Computer Science and Engineering Washington
High-Performance Integer Factoring with Reconfigurable Devices
FPL 2010, Milan, August 31st September 2nd, 2010 High-Performance Integer Factoring with Reconfigurable Devices Ralf Zimmermann, Tim Güneysu, Christof Paar Horst Görtz Institute for IT-Security Ruhr-University
Users Guide: Fast IP Lookup (FIPL) in the FPX
Users Guide: Fast IP Lookup (FIPL) in the FPX Gigabit Kits Workshop /22 FIPL System Design Each FIPL Engine performs a longest matching prefix lookup on a single 32-bit IPv4 destination address FIPL Engine
Dynamically Configurable Online Statistical Flow Feature Extractor on FPGA
Dynamically Configurable Online Statistical Flow Feature Extractor on FPGA Da Tong, Viktor Prasanna Ming Hsieh Department of Electrical Engineering University of Southern California Email: {datong, prasanna}@usc.edu
1. INTRODUCTION 2. BACKGROUND. outputs scores that indicate proximity to known topics or dialects of a language.
Sensitivity Analysis of Gigabit Concept Mining System Andrew Levine, Ron Loui, John W. Lockwood, Young H. Cho Reconfigurable Network Group Washington University in St. Louis 1 Brookings Drive, St. Louis
Background on Bloom Filter
CSE 535 : Lecture 5 String Matching with Bloom Filters Washington University Fall 23 http://www.arl.wustl.edu/arl/projects/fpx/cse535/ Copyright 23, Sarang Dharmapurikar [Guest Lecture] CSE 535 : Fall
Scalable Multi-Pipeline Architecture for High Performance Multi-Pattern String Matching
Scalable Multi-Pipeline Architecture for High Performance Multi-Pattern String Matching Weirong Jiang, Yi-Hua E. Yang and Viktor K. Prasanna Ming Hsieh Department of Electrical Engineering University of
Table of Contents...2 Abstract...3 Protocol Flow Analyzer...3
TABLE OF CONTENTS Table of Contents...2 Abstract...3 Protocol Flow Analyzer...3 What is a Protocol Flow?...3 Protocol Flow Analysis...3 Benefits of Protocol Flow Analysis...4 HTTP Flow Analyzer Overview...4
INTRODUCTION TO FPGA ARCHITECTURE
3/3/25 INTRODUCTION TO FPGA ARCHITECTURE DIGITAL LOGIC DESIGN (BASIC TECHNIQUES) a b a y 2input Black Box y b Functional Schematic a b y a b y a b y 2 Truth Table (AND) Truth Table (OR) Truth Table (XOR)
Index Terms- Field Programmable Gate Array, Content Addressable memory, Intrusion Detection system.
Dynamic Based Reconfigurable Content Addressable Memory for FastString Matching N.Manonmani 1, K.Suman 2, C.Udhayakumar 3 Dept of ECE, Sri Eshwar College of Engineering, Kinathukadavu, Coimbatore, India1
Application Protocol Breakdown
Snort 2.0: Protocol Flow Analyzer Authors: Daniel Roelker Sourcefire Inc. Marc Norton Sourcefire Inc. Abstract The Snort 2.0 Protocol Flow Analyzer
Structural Framework for High Speed Intrusion Detection/Prevention Signature Based Systems
IJCSNS International Journal of Computer Science and Network Security, VOL.6 No.9B, September 2006 175 Structural Framework for High Speed Intrusion Detection/Prevention Signature Based Systems Vukašin
SHA3 Core Specification. Author: Homer Hsing
SHA3 Core Specification Author: Homer Hsing homer.hsing@gmail.com Rev. 0.1 January 29, 2013 This page has been intentionally left blank. www.opencores.org Rev 0.1 ii Rev. Date Author Description 0.1 01/29/2013
HIGH-PERFORMANCE NETWORK SECURITY USING NETWORK INTRUSION DETECTION SYSTEM APPROACH
Vol. 6 Special Issue 1 December 2017 ISSN: 2320-4168 HIGH-PERFORMANCE NETWORK SECURITY USING NETWORK INTRUSION DETECTION SYSTEM APPROACH M.Sathiya Assistant Professor, Department of Computer Science &
Computer Science at Kent
Computer cience at Kent An Intrusion Detection ystem for Gigabit Networks Architecture and an example system Gerald Tripp Technical Report No. 7-04 April 004 Copyright 004 University of Kent at Canterbury
PACKET classification is a prominent technique used in
IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 25, NO. 5, MAY 2014 1135 A Scalable and Modular Architecture for High-Performance Packet Classification Thilan Ganegedara, Weirong Jiang, and
Towards Effective Packet Classification. J. Li, Y. Qi, and B. Xu Network Security Lab RIIT, Tsinghua University Dec, 2005
Towards Effective Packet Classification J. Li, Y. Qi, and B. Xu Network Security Lab RIIT, Tsinghua University Dec, 2005 Outline Algorithm Study Understanding Packet Classification Worst-case Complexity