Hardware Pattern Matching for Intrusion Prevention Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion Prevention Systems (IPS) face challenges in quickly and accurately identifying signature data patterns across network traffic at high speeds while efficiently managing computing resources, often resulting in false positives with approximate-pattern-matching techniques and high resource usage with exact-pattern-matching techniques.
Innovation Solution
The implementation of hardware-based pattern-matching techniques using partial-match and full-match hardware within IPS to determine exact matches between subject data words and signature data patterns, reducing the number of data words examined and optimizing resource usage through pre-processing, partial-match, and full-match determinations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If approximate-pattern-matching techniques are used, then resource consumption is reduced, but measurement precision deteriorates resulting in false positives
Solution Approach 1:
The pattern matching process is divided into two distinct hardware stages: partial-match hardware that performs initial filtering using a subset of signature bits, and full-match hardware that performs verification. This segmentation allows the system to use less resource-intensive approximate matching for most packets while reserving exact matching resources only for candidates that pass the initial filter, thereby resolving the contradiction between resource consumption and matching accuracy.
2Measurement precision
If exact-pattern-matching techniques are used, then measurement precision is improved, but resource consumption increases
Solution Approach 1:
The partial-match hardware performs an incomplete matching operation using only a portion of the signature bits (e.g., every other bit or a selected subset). This partial action is sufficient to filter out the majority of non-matching packets with minimal resource consumption. The full-match hardware then completes the verification for only those packets that passed the partial match, ensuring exact matching accuracy is maintained where needed while overall resource usage is dramatically reduced.
3Productivity
If hardware-based full pattern matching is implemented, then productivity is improved, but device complexity increases
Solution Approach 1:
The hardware architecture is segmented into two functional units: partial-match hardware containing a subset of signature bits and comparison logic, and full-match hardware containing the complete signature and verification logic. This segmentation enables parallel processing at hardware speeds while keeping each individual unit relatively simple. The partial-match unit handles the bulk of filtering work with minimal complexity, and the full-match unit deals with a reduced set of candidates, thereby achieving high productivity without excessive overall complexity.
Data Source
AI summary
Methods and systems are provided for hardware-based pattern matching. In an embodiment, an intrusion-prevention system (IPS) identifies a full match between a subject data word comprising subject-data blocks and a signature data pattern comprising signature-data blocks. The IPS receives the subject data word via a network interface, and thereafter makes a partial-match determination that two or more but less than all of the subject-data blocks respectively match the same number of the signature-data blocks stored in partial-match hardware with respect to both value and position. Thereafter, the IPS makes a full-match determination that all of the subject-data blocks respectively match all of the signature-data blocks stored in the IPS's full-match hardware with respect to both value and position. The IPS then stores an indicator that the full-match determination has been made, and may carry out one or more additional intrusion-prevention responses as well.