Improved TCAM-based pre-filtering for network intrusion detection systems

Yeim Kuan Chang, Ming Li Tsai, Cheng Chien Su

Research output: Chapter in Book/Report/Conference proceedingConference contribution

7 Citations (Scopus)

Abstract

With the increasing growth of the Internet, the explosion of attacks and viruses significantly affects the network security. Network Intrusion Detection System (NIDS) is developed to identify these network attacks by a set of rules. However, searching for multiple patterns is a computationally expensive task in NIDS. Traditional software-based solutions can not meet the high bandwidth demanded in current high-speed networks. In the past, the pre-filtering designed for NIDS is an effective technique that can reduce the processing overhead significantly. A FNPlike TCAM searching engine (FTSE) [5] [6] is an example that uses an 2-stage architecture to detect whether an incoming string contains patterns. In this paper, we propose two techniques to improve the performance of FTSE that utilizes ternary content addressable memory (TCAM) as pre-filter to achieve gigabit performance. The first technique performs the w-byte suffix pattern match instead of using w-byte prefix. The second technique finds the matching results from all groups rather than first group. We Anally present the simulation result using Snort pattern set and DEFCON packet traces.

Original languageEnglish
Title of host publicationProceedings - 22nd International Conference on Advanced Information Networking and Applications, AINA 2008
Pages985-990
Number of pages6
DOIs
Publication statusPublished - 2008
Event22nd International Conference on Advanced Information Networking and Applications, AINA 2008 - Gino-wan, Okinawa, Japan
Duration: 2008 Mar 252008 Mar 28

Publication series

NameProceedings - International Conference on Advanced Information Networking and Applications, AINA
ISSN (Print)1550-445X

Other

Other22nd International Conference on Advanced Information Networking and Applications, AINA 2008
CountryJapan
CityGino-wan, Okinawa
Period08-03-2508-03-28

All Science Journal Classification (ASJC) codes

  • Engineering(all)

Fingerprint Dive into the research topics of 'Improved TCAM-based pre-filtering for network intrusion detection systems'. Together they form a unique fingerprint.

Cite this