High Speed Network Intrusion Detection System (NIDS) Using Low Power Precomputation Based Content Addressable Memory

摘要

NIDS (Network Intrusion Detection Systems) plays a vital role in security threats to computers and networks. With the onset of gigabit networks, hardware-based Intrusion Detection System gains popularity because of its high performance when compared to the software-based NIDS. The software-based system limits parallel execution, which in turn confines the performance of a modern network. This paper presents a signature-based lookup technique using reconfigurable hardware. Content Addressable Memory (CAM) is used as a lookup table architecture to improve the speed instead of search algorithms. To minimize the power and to increase the speed, pre-computation based CAM (PBCAM) can be used, as this technique avoids repeated search comparisons. PBCAM employs the two-stage comparison with a parameter memory in the first stage and data memory in the second stage. Only the matched data in the parameter memory are compared in the data memory. This reduces the number of comparisons, thereby increasing the speed of the system. In this work dual-port RAM-based PBCAM (DP-PBCAM) is used to design a signature-based intrusion detection system. A low power parameter extractor is used with a minimum number of gates for precomputation. The hardware implementation is done using Xilinx Spartan 3E FPGA. The proposed DP-PBCAM lookups support a gigabit-speed of 7.42 Gbps.