Cloud Intrusion Prevention System Using FPGA Pre-Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion prevention systems face challenges in efficiently inspecting high volumes of network traffic in real-time due to resource-intensive machine learning requirements, which can impede network flow and increase latency.
Innovation Solution
A two-stage hybrid architecture utilizing programmable integrated circuit chip instances (FPGA) for pre-processing network packets, where clean packets are allowed to pass while suspicious ones are forwarded to distributed compute instances for further inspection, leveraging available resources to accelerate the process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning techniques are used for network traffic inspection, then detection accuracy is improved, but resource consumption and latency increase
Solution Approach 1:
The inspection system is segmented into two distinct stages: a hardware-based pre-processing stage using FPGA instances for rapid packet filtering, and a software-based post-processing stage using compute instances for machine learning analysis. This segmentation allows simple packets to be processed quickly in hardware while reserving computational resources for complex analysis only when needed.
Solution Approach 2:
The FPGA instances perform preliminary filtering of network packets before they reach the machine learning processing stage. By pre-processing packets in hardware and identifying suspicious patterns early, the system avoids subjecting all packets to resource-intensive machine learning analysis, thereby reducing overall latency and resource consumption.
2Measurement precision
If machine learning techniques are used for network traffic inspection, then detection accuracy is improved, but resource utilization increases
Solution Approach 1:
The system segments processing tasks between hardware (FPGA) and software (compute instances) components. The FPGA handles resource-efficient pre-processing for all packets, while machine learning resources are allocated only for post-processing of suspicious packets, significantly reducing overall resource consumption compared to applying machine learning to all traffic.
Solution Approach 2:
Instead of applying full machine learning analysis to all network packets, the system applies partial processing (FPGA pre-processing) to all packets and reserves excessive computational resources (machine learning on compute instances) only for the subset of packets that require deeper inspection, optimizing resource utilization.
3Reliability
If all packets are inspected in real-time, then security coverage is improved, but network flow is impeded
Solution Approach 1:
The inspection architecture is segmented into parallel processing paths: a fast hardware path for clean packets that maintains network flow, and a slower software path for suspicious packets that ensures security coverage. This segmentation allows the system to provide comprehensive security inspection while minimizing impact on overall network throughput.
Solution Approach 2:
The FPGA instances act as intermediaries between the network gateway and compute instances. They pre-process all incoming packets, filter out clean traffic, and forward only suspicious packets to the compute instances for machine learning analysis. This intermediary role ensures both security coverage and network flow efficiency.
4Productivity
If a two-stage hybrid architecture is used, then processing efficiency is improved, but device complexity increases
Solution Approach 1:
The system is segmented into modular components (FPGA instances, compute instances, network gateway) that can be independently deployed and managed. This modular segmentation improves processing efficiency while making the complexity manageable through clear separation of concerns and independent scalability of each component.
Data Source
AI summary
One embodiment of the presently-disclosed invention relates to an intrusion prevention system that includes a plurality of FPGA instances and a plurality of compute instances in a cloud network. The plurality of FPGA instances perform pre-processing that determines whether data packets received from the network gateway are associated with suspicious flows. The data packets associated with the suspicious flows are communicated from the plurality of FPGA instances to a plurality of compute instances in the cloud network. The plurality of compute instances perform post-processing that determines whether a suspicious flow is malicious. Other embodiments, aspects and features are also disclosed.