Detail publikace

Deep Packet Inspection in FPGAs via Approximate Nondeterministic Automata

HAVLENA, V. ČEŠKA, M. HOLÍK, L. KOŘENEK, J. LENGÁL, O. MATOUŠEK, D. MATOUŠEK, J. SEMRIČ, J. VOJNAR, T.

Originální název

Deep Packet Inspection in FPGAs via Approximate Nondeterministic Automata

Typ

článek ve sborníku ve WoS nebo Scopus

Jazyk

angličtina

Originální abstrakt

Deep packet inspection via regular expression (RE) matching is a crucial task of network intrusion detection systems (IDSes), which secure Internet connection against attacks and suspicious network traffic. Monitoring high-speed computer networks (100 Gbps and faster) in a single-box solution demands that the RE matching, traditionally based on finite automata (FAs), is accelerated in hardware. In this paper, we describe a novel FPGA architecture for RE matching that is able to process network traffic beyond 100 Gbps. The key idea is to reduce the required FPGA resources by leveraging approximate nondeterministic FAs (NFAs). The NFAs are compiled into a multi-stage architecture starting with the least precise stage with a high throughput and ending with the most precise stage with a low throughput. To obtain the reduced NFAs, we propose new approximate reduction techniques that take into account the profile of the network traffic. Our experiments showed that using our approach, we were able to perform matching of large sets of REs from Snort, a popular IDS, on unprecedented network speeds.

Klíčová slova

intrusion detection system, deep packet inspection, finite automata, approximate reduction

Autoři

HAVLENA, V.; ČEŠKA, M.; HOLÍK, L.; KOŘENEK, J.; LENGÁL, O.; MATOUŠEK, D.; MATOUŠEK, J.; SEMRIČ, J.; VOJNAR, T.

Vydáno

1. 4. 2019

Nakladatel

Institute of Electrical and Electronics Engineers

Místo

San Diego, CA

ISBN

978-1-7281-1131-5

Kniha

Proceedings - 27th IEEE International Symposium on Field-Programmable Custom Computing Machines, FCCM 2019

Strany od

109

Strany do

117

Strany počet

9

URL

https://www.fit.vut.cz/research/publication/11951/

BibTex

@inproceedings{BUT158077,
  author="Vojtěch {Havlena} and Milan {Češka} and Lukáš {Holík} and Jan {Kořenek} and Ondřej {Lengál} and Denis {Matoušek} and Jiří {Matoušek} and Jakub {Semrič} and Tomáš {Vojnar}",
  title="Deep Packet Inspection in FPGAs via Approximate Nondeterministic Automata",
  booktitle="Proceedings - 27th IEEE International Symposium on Field-Programmable Custom Computing Machines, FCCM 2019",
  year="2019",
  pages="109--117",
  publisher="Institute of Electrical and Electronics Engineers",
  address="San Diego, CA",
  doi="10.1109/FCCM.2019.00025",
  isbn="978-1-7281-1131-5",
  url="https://www.fit.vut.cz/research/publication/11951/"
}