Reconfigurable Filter for Network Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network processing technologies face challenges in efficiently accelerating string matching for intrusion detection and virus detection due to high computational intensity and the difficulty in achieving line-rate performance at high data rates, especially when using Bloom filters and state-of-the-art processors.
Innovation Solution
A reconfigurable filter apparatus comprising a set of string matching slice circuits that perform parallel operations, using Galois-field polynomials to generate hash indices and an AND-OR logic array to combine slice-hit signals, allowing for simultaneous matching of different byte patterns and reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Bloom filters and state-of-the-art processors are used for string matching in packet inspection, then intrusion detection and virus detection capabilities are provided, but computational intensity is very high and line-rate performance cannot be achieved at high data rates
Solution Approach 1:
The filter is divided into multiple independent string matching slice circuits, each capable of processing specific byte patterns in parallel. This segmentation allows the system to distribute the computational load across multiple processing units, achieving line-rate performance at high data rates while maintaining comprehensive intrusion detection capability.
Solution Approach 2:
The patent transitions from sequential processing in traditional processors to parallel processing across multiple slice circuits operating simultaneously. By adding the dimension of parallelism through reconfigurable hardware architecture, the system achieves both high reliability for detection and high productivity for processing speed.
2Reliability
If traditional processors are used for pattern matching, then intrusion detection is performed, but processing rates cannot reach line-rate even with optimizations
Solution Approach 1:
The patent replaces traditional mechanical/sequential processor operations with reconfigurable hardware circuitry that performs parallel pattern matching. The slice circuits are configured to simultaneously evaluate multiple byte patterns against incoming data streams, achieving line-rate processing speeds while maintaining the accuracy required for reliable intrusion detection.
3Productivity
If specialized field-programmable gate array solutions or custom circuits are used, then line-rate performance is achieved, but device complexity and manufacturing difficulty increase
Solution Approach 1:
The patent employs reconfigurable slice circuits that can be dynamically configured to match different byte patterns and adapt to varying threat signatures. This dynamic reconfigurability allows the system to maintain line-rate performance across different detection scenarios without requiring completely different hardware designs, thereby managing device complexity while preserving high productivity.
4Measurement precision
If multiple hash functions are used in Bloom filters, then false positive rate is reduced, but computational overhead increases
Solution Approach 1:
The patent extracts the essential pattern matching function from complex Bloom filter operations and implements it directly in reconfigurable hardware slice circuits. By taking out the core matching logic and implementing it in parallel hardware, the system achieves high match accuracy without the computational overhead of multiple sequential hash function evaluations, thereby reducing energy consumption while maintaining precision.
Data Source
AI summary
Methods and apparatus to perform string matching for network packet inspection are disclosed. In some embodiments there is a set of string matching slice circuits, each slice circuit of the set being configured to perform string matching steps in parallel with other slice circuits. Each slice circuit may include an input window storing some number of bytes of data from an input data steam. The input window of data may be padded if necessary, and then multiplied by a polynomial modulo an irreducible Galois-field polynomial to generate a hash index. A storage location of a memory corresponding to the hash index may be accessed to generate a slice-hit signal of a set of H slice-hit signals. The slice-hit signal may be provided to an AND-OR logic array where the set of H slice-hit signals is logically combined into a match result.