TriBiCa Data Structure for Scalable Network Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network intrusion detection and prevention systems face challenges in scalability and efficiency, particularly in deep packet inspection, due to high computational complexity and the need for frequent updates, which are often addressed inadequately by existing hardware-based solutions.
Innovation Solution
The TriBiCa (Trie Bitmap Content Analyzer) data structure provides minimal perfect hashing functionality and supports low-cost set-membership queries, allowing for high-speed matching of arbitrary-length bit strings without hardware modifications, enabling efficient filtering of irrelevant traffic and scalable performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If hardware-based solutions are used for deep packet inspection, then processing speed is improved, but device complexity and cost increase
Solution Approach 1:
The signature set is divided into multiple subsets, with each subset stored in a separate content addressable memory (CAM) module. This segmentation allows parallel processing of different signature subsets, achieving high processing speed while keeping each individual CAM module relatively simple and cost-effective.
Solution Approach 2:
The patent transitions from traditional sequential processing to parallel processing by adding the dimension of multiple CAM modules operating simultaneously. Each CAM module handles a specific subset of signatures in parallel, dramatically improving throughput while maintaining reasonable complexity per module.
2Reliability
If the signature set is updated frequently, then detection accuracy is improved, but hardware reconfiguration time and complexity increase
Solution Approach 1:
The system employs dynamic signature subset assignment where signatures can be flexibly added, removed, or moved between subsets without requiring complete system reconfiguration. This dynamic approach allows frequent updates to maintain detection accuracy while avoiding complex hardware reconfiguration.
Solution Approach 2:
Each CAM module is designed to be universal and can store any signature subset. This multi-functionality allows the system to dynamically reassign signatures between modules based on update requirements, simplifying the update process and reducing reconfiguration complexity.
3Reliability
If more signature strings are added to improve detection coverage, then detection capability is improved, but processing time increases
Solution Approach 1:
By segmenting the large signature set into multiple smaller subsets distributed across parallel CAM modules, the system achieves comprehensive detection coverage while maintaining fast processing. Each module processes its subset independently and simultaneously, preventing processing time from increasing linearly with the total number of signatures.
Solution Approach 2:
The parallel architecture ensures continuous processing of multiple signature subsets simultaneously, maximizing utilization of processing resources. All CAM modules operate concurrently without idle time, maintaining high detection capability while minimizing overall processing time.
Data Source
AI summary
Generating and using a high-speed, scalable, and easily updateable data structure are described. The proposed data structure provides minimal perfect hashing functionality while intrinsically supporting low-cost set-membership queries. In other words, in some embodiments, it provides at most one match candidate in a set of known arbitrary-length bit strings that is used to match the query.