Field programmable gate array-based (FPGA-based) intrusion detection system and method

Abstract

The invention relates to a field programmable gate array-based (FPGA-based) intrusion detection system and a FPGA-based intrusion detection method and belongs to the technical field of network security. The invention is characterized in that FPGA-based intrusion detection method is designed and realized; the processing performance is promoted by a realization mode of a hardware circuit; packet classification is realized by selecting a binary tree structure packet classification algorithm; character matching is realized by adopting an exclusive or (XOR) Hash algorithm which is suitable for FPGA processing; the rule updating is realized through performing addition or correction on the basis of the original intrusion rule realization logic; and Hash collision is eliminated through a method of performing independent matching on the Hash collision.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to an FPGA-based intrusion detection system and method. Background technique [0002] As the network security is paid more and more attention, the intrusion detection system as the core technology and implementation difficulty of network security is also more and more concerned by people. The intrusion detection system includes two parts: character matching and packet classification. [0003] At present, the two parts of character matching and packet classification in intrusion security mainly adopt hardware and software methods at home and abroad. Among them, software-based matching algorithms include BM algorithm, Aho-Corasick algorithm, AC-BM improved algorithm, etc., whose processing speed is relatively slow, and it is difficult to meet the requirements of current network development. The more popular one based on hardware is the processing method based on FPGA. Using...

AI Technical Summary

Problems solved by technology

However, its resource utilization rate is relatively poor, and some special methods must be used to achieve the purpose of resource sharing.

Based on CAM, the string matching algorithm implemented by TCAM has a fast matching speed, but its price is quite expensive, its capacity is small, and its power consumption is large, so it is only suitable for small-scale rule bases.

Images