IEICE TRANSACTIONS on Information
FPGA-Based Intrusion Detection System for 10 Gigabit Ethernet
Summary :
The present paper describes an implementation of an intrusion detection system (IDS) on an FPGA for 10 Gigabit Ethernet. The system includes an exact string matching circuit for 1,225 Snort rules on a single device. A number of studies have examined string matching circuits for IDS. However, implementing a circuit that processes a large rule set at high throughput is difficult. In a previous study, we proposed a method for generating an NFA-based string matching circuit that has expandability of processing data width and drastically reduced resource requirements. In the present paper, we implement an IDS circuit that processes 1,225 Snort rules at 10 Gbps with a single Xilinx Virtex-II Pro xc2vp-100 using the NFA-based method. The proposed circuit also provides packet filtering for an intrusion protection system (IPS). In addition, we developed a tool for automatically generating the Verilog HDL source code of the IDS circuit from a Snort rule set. Using the FPGA and the IDS circuit generator, the proposed system is able to update the matching rules corresponding to new intrusions and attacks. We implemented the IDS circuit on an FPGA board and evaluated its accuracy and throughput. As a result, we confirmed in a test that the circuit detects attacks perfectly at the wire speed of 10 Gigabit Ethernet.
- Publication
- IEICE TRANSACTIONS on Information Vol.E90-D No.12 pp.1923-1931
- Publication Date
- 2007/12/01
- Publicized
- Online ISSN
- 1745-1361
- DOI
- 10.1093/ietisy/e90-d.12.1923
- Type of Manuscript
- Special Section PAPER (Special Section on Reconfigurable Systems)
- Category
- Reconfigurable System and Applications
Authors
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Toshihiro KATASHITA, Yoshinori YAMAGUCHI, Atusi MAEDA, Kenji TODA, "FPGA-Based Intrusion Detection System for 10 Gigabit Ethernet" in IEICE TRANSACTIONS on Information,
vol. E90-D, no. 12, pp. 1923-1931, December 2007, doi: 10.1093/ietisy/e90-d.12.1923.
Abstract: The present paper describes an implementation of an intrusion detection system (IDS) on an FPGA for 10 Gigabit Ethernet. The system includes an exact string matching circuit for 1,225 Snort rules on a single device. A number of studies have examined string matching circuits for IDS. However, implementing a circuit that processes a large rule set at high throughput is difficult. In a previous study, we proposed a method for generating an NFA-based string matching circuit that has expandability of processing data width and drastically reduced resource requirements. In the present paper, we implement an IDS circuit that processes 1,225 Snort rules at 10 Gbps with a single Xilinx Virtex-II Pro xc2vp-100 using the NFA-based method. The proposed circuit also provides packet filtering for an intrusion protection system (IPS). In addition, we developed a tool for automatically generating the Verilog HDL source code of the IDS circuit from a Snort rule set. Using the FPGA and the IDS circuit generator, the proposed system is able to update the matching rules corresponding to new intrusions and attacks. We implemented the IDS circuit on an FPGA board and evaluated its accuracy and throughput. As a result, we confirmed in a test that the circuit detects attacks perfectly at the wire speed of 10 Gigabit Ethernet.
URL: https://global.ieice.org/en_transactions/information/10.1093/ietisy/e90-d.12.1923/_p
Copy
@ARTICLE{e90-d_12_1923,
author={Toshihiro KATASHITA, Yoshinori YAMAGUCHI, Atusi MAEDA, Kenji TODA, },
journal={IEICE TRANSACTIONS on Information},
title={FPGA-Based Intrusion Detection System for 10 Gigabit Ethernet},
year={2007},
volume={E90-D},
number={12},
pages={1923-1931},
abstract={The present paper describes an implementation of an intrusion detection system (IDS) on an FPGA for 10 Gigabit Ethernet. The system includes an exact string matching circuit for 1,225 Snort rules on a single device. A number of studies have examined string matching circuits for IDS. However, implementing a circuit that processes a large rule set at high throughput is difficult. In a previous study, we proposed a method for generating an NFA-based string matching circuit that has expandability of processing data width and drastically reduced resource requirements. In the present paper, we implement an IDS circuit that processes 1,225 Snort rules at 10 Gbps with a single Xilinx Virtex-II Pro xc2vp-100 using the NFA-based method. The proposed circuit also provides packet filtering for an intrusion protection system (IPS). In addition, we developed a tool for automatically generating the Verilog HDL source code of the IDS circuit from a Snort rule set. Using the FPGA and the IDS circuit generator, the proposed system is able to update the matching rules corresponding to new intrusions and attacks. We implemented the IDS circuit on an FPGA board and evaluated its accuracy and throughput. As a result, we confirmed in a test that the circuit detects attacks perfectly at the wire speed of 10 Gigabit Ethernet.},
keywords={},
doi={10.1093/ietisy/e90-d.12.1923},
ISSN={1745-1361},
month={December},}
Copy
TY - JOUR
TI - FPGA-Based Intrusion Detection System for 10 Gigabit Ethernet
T2 - IEICE TRANSACTIONS on Information
SP - 1923
EP - 1931
AU - Toshihiro KATASHITA
AU - Yoshinori YAMAGUCHI
AU - Atusi MAEDA
AU - Kenji TODA
PY - 2007
DO - 10.1093/ietisy/e90-d.12.1923
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E90-D
IS - 12
JA - IEICE TRANSACTIONS on Information
Y1 - December 2007
AB - The present paper describes an implementation of an intrusion detection system (IDS) on an FPGA for 10 Gigabit Ethernet. The system includes an exact string matching circuit for 1,225 Snort rules on a single device. A number of studies have examined string matching circuits for IDS. However, implementing a circuit that processes a large rule set at high throughput is difficult. In a previous study, we proposed a method for generating an NFA-based string matching circuit that has expandability of processing data width and drastically reduced resource requirements. In the present paper, we implement an IDS circuit that processes 1,225 Snort rules at 10 Gbps with a single Xilinx Virtex-II Pro xc2vp-100 using the NFA-based method. The proposed circuit also provides packet filtering for an intrusion protection system (IPS). In addition, we developed a tool for automatically generating the Verilog HDL source code of the IDS circuit from a Snort rule set. Using the FPGA and the IDS circuit generator, the proposed system is able to update the matching rules corresponding to new intrusions and attacks. We implemented the IDS circuit on an FPGA board and evaluated its accuracy and throughput. As a result, we confirmed in a test that the circuit detects attacks perfectly at the wire speed of 10 Gigabit Ethernet.
ER -
English
