Deep Packet Inspection in FPGAs via Approximate Nondeterministic Automata

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216305%3A26230%2F19%3APU132977" target="_blank" >RIV/00216305:26230/19:PU132977 - isvavai.cz</a>

Výsledek na webu

<a href="https://www.fit.vut.cz/research/publication/11951/" target="_blank" >https://www.fit.vut.cz/research/publication/11951/</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/FCCM.2019.00025" target="_blank" >10.1109/FCCM.2019.00025</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Deep Packet Inspection in FPGAs via Approximate Nondeterministic Automata

Popis výsledku v původním jazyce

Deep packet inspection via regular expression (RE) matching is a crucial task of network intrusion detection systems (IDSes), which secure Internet connection against attacks and suspicious network traffic. Monitoring high-speed computer networks (100 Gbps and faster) in a single-box solution demands that the RE matching, traditionally based on finite automata (FAs), is accelerated in hardware. In this paper, we describe a novel FPGA architecture for RE matching that is able to process network traffic beyond 100 Gbps. The key idea is to reduce the required FPGA resources by leveraging approximate nondeterministic FAs (NFAs). The NFAs are compiled into a multi-stage architecture starting with the least precise stage with a high throughput and ending with the most precise stage with a low throughput. To obtain the reduced NFAs, we propose new approximate reduction techniques that take into account the profile of the network traffic. Our experiments showed that using our approach, we were able to perform matching of large sets of REs from Snort, a popular IDS, on unprecedented network speeds.

Název v anglickém jazyce

Deep Packet Inspection in FPGAs via Approximate Nondeterministic Automata

Popis výsledku anglicky

Deep packet inspection via regular expression (RE) matching is a crucial task of network intrusion detection systems (IDSes), which secure Internet connection against attacks and suspicious network traffic. Monitoring high-speed computer networks (100 Gbps and faster) in a single-box solution demands that the RE matching, traditionally based on finite automata (FAs), is accelerated in hardware. In this paper, we describe a novel FPGA architecture for RE matching that is able to process network traffic beyond 100 Gbps. The key idea is to reduce the required FPGA resources by leveraging approximate nondeterministic FAs (NFAs). The NFAs are compiled into a multi-stage architecture starting with the least precise stage with a high throughput and ending with the most precise stage with a low throughput. To obtain the reduced NFAs, we propose new approximate reduction techniques that take into account the profile of the network traffic. Our experiments showed that using our approach, we were able to perform matching of large sets of REs from Snort, a popular IDS, on unprecedented network speeds.

Druh

D - Stať ve sborníku

CEP obor

—

OECD FORD obor

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Projekt

<a href="/cs/project/LQ1602" target="_blank" >LQ1602: IT4Innovations excellence in science</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2019

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Proceedings of the 27th IEEE International Symposium on Field-Programmable Custom Computing Machines (FCCM)

ISBN

978-1-7281-1132-2

ISSN

—

e-ISSN

—

Počet stran výsledku

9

Strana od-do

109-117

Název nakladatele

Institute of Electrical and Electronics Engineers

Místo vydání

San Diego, CA

Místo konání akce

San Diego, CA

Datum konání akce

28. 4. 2019

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

000491873200016