FPGA-Based Network Intrusion Detection Systems

[[abstract]]The objective of this project is to develop a novel FPGA-based signature match co-processor that can serve as the core of a hardware-based network intrusion detection system (NIDS). The key feature of the signature match co-processor is an architecture based on the shift-or algorithm. Our first implementation of the architecture contains only shift registers, or-gates and ROMs where patterns are stored. Although the architecture is simple, the ROM may operate at slower clock rate as compared with the logic elements (LEs) in the FPGAs. Therefore, the throughput of the circuit may be limited by the speed of the embedded memory bits. The second architecture proposed in this project replaces the ROMs with a bitmap encoder for the shift-or operations. The symbol encoder does not consume embedded memory bits. The proposed system therefore may have higher throughput as compared with the ROM-based architectures. To further improve the throughput of the proposed circuit, we also extend the symbol encoder so that it can process multiple characters at a time. The proposed architectures will be prototyped, simulated and synthesized by the Altera Stratix and Xilinx Virtex FPGA. In addition, an embedded system integrating the proposed architectures with the Xilinx softcore Microblaze CPU has been implemented. The resulting system will be used as a hardware-based NIDS for the physical performance measurement of our proposed architectures. Because of its high throughput for signature matching operations, the hardware-based NIDS significantly outperforms the software-based NIDS for high bandwidth networks.