TRAFFIC SCANNER – HARDWARE ACCELERATED INTRUSION DETECTION SYSTEM

Intrusion detection systems such as Snort are capable of detecting numerous of security threats in network traffic. The most computation-intensive part of these systems is searching thousands of patterns that must be performed on gigabits speeds. But software based IDS solution can not handle this task effectively and they are not able to archive throughput higher than 300 Mbps. This paper presents the system architecture of the Traffic Scanner which is hardware accelerated IDS based on Field-Programmable Gate Arrays (FPGAs). The designed system supports rules described in Snort-compatible format and can be configured using a web interface. System uses an architecture based on non-deterministic finite automaton for fast pattern matching. Using this approach, throughput up to 3.2 Gbps is achieved on the COMBO6X card for all rules from Snort database