A Performance and Area Efficient Architecture for Intrusion Detection Systems

Govind Sreekar Shenoy, Jordi Tubella, Antonio González

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Intrusion Detection Systems (IDS) have emerged as one of the most promising ways to secure systems in network. An IDS operates by scanning packet-data for known signatures and accordingly takes requisite action. However, scanning bytes in the packet payload and checking for more than 20,000 signatures becomes a computationally intensive task. Additionally, with signatures doubling almost every 30 months, this complexity will aggravate further. IDS commonly uses the Aho-Corasick state machine based search to scan packets for signatures. However, the huge size of the state machine negatively impacts the performance and area efficiency of the underlying hardware. In this work, we propose novel mechanisms to compactly store the state machine thereby improving the area efficiency. We observe over 2X reduction in area for storing the state machine in comparison to BS-FSM [19]. We investigate various approaches to improve the performance efficiency. We pipeline the processing of consecutive bytes accessing the upper-most level, the frequently accessed level, of the state machine. In order to further enhance the performance efficiency, we use a dedicated hardware unit specifically tuned for traversal using our proposed storage mechanism. We observe that our proposed architecture outperforms BS-FSM based approaches [13, 14, 19].
Original languageEnglish
Title of host publicationParallel & Distributed Processing Symposium (IPDPS), 2011 IEEE International
Place of PublicationWashington, DC, USA
PublisherInstitute of Electrical and Electronics Engineers (IEEE)
Pages301-310
Number of pages10
ISBN (Print)978-1-61284-372-8
DOIs
Publication statusPublished - 2011

Fingerprint

Dive into the research topics of 'A Performance and Area Efficient Architecture for Intrusion Detection Systems'. Together they form a unique fingerprint.

Cite this