东北大学学报（自然科学版）

东北大学学报(自然科学版) ›› 2013, Vol. 34 ›› Issue (3): 339-343.DOI: -

• 信息与控制 • 上一篇    下一篇

入侵检测中字符匹配系统的FPGA实现

李晶皎1，陈勇1，许哲万1,2，陆振林1   

  1. (1.东北大学信息科学与工程学院，辽宁沈阳110819；2.金日成综合大学计算机科学学院，朝鲜平壤999093)
  • 收稿日期:2012-07-12 修回日期:2012-07-12 出版日期:2013-03-15 发布日期:2013-01-26
  • 通讯作者: 李晶皎
  • 作者简介:李晶皎(1964-)，女，辽宁沈阳人，东北大学教授，博士生导师.
  • 基金资助:
    国家自然科学基金资助项目(60970157)；辽宁省博士启动基金资助项目(2081019).

FPGA Implementation of String Matching System in Intrusion Detection

LI Jingjiao1， CHEN Yong1， HO Cholman1,2， LU Zhenlin1   

  1. 1. School of Information Science ＆ Engineering， Northeastern University， Shenyang 110819， China; 2. College of Computer Science， Kim IL Sung University， PyongYang 999093， DPR of Korea.
  • Received:2012-07-12 Revised:2012-07-12 Online:2013-03-15 Published:2013-01-26
  • Contact: CHEN Yong
  • About author:-
  • Supported by:
    -

RichHTML

1

PDF (PC)

1047

摘要： 在入侵检测系统中，由于基于软件的字符匹配系统受处理器性能与软件串行执行等因素影响，处理速度有限，故设计并实现了基于FPGA的字符匹配系统.以硬件电路的实现方式提升处理性能，并采用了适合于FPGA运算的XORHash算法快速计算地址，从地址中取数据进行匹配，并实现数据的并行处理.通过在原有入侵规则实现逻辑上进行修正，实现规则的更新，通过预处理对冲突的模式串单独匹配解决了冲突.实验结果显示，系统的数据处理能力达到了129Gbps，为软件方法的35倍以上.当处理更多Snort规则时，系统吞吐量不受影响，资源的消耗增加很少.

关键词: 字符匹配, FPGA, 入侵检测, XORHash算法, Hash冲突

Abstract: In the intrusion detection system， due to processor’s performance and serial execution， the processing speed of softwarebased string matching system is limited. ASICbased string matching system can provide high throughputs， but its pattern strings is difficult to update. In order to improve processing speed and adapt to the detection rules’ update， a string matching system based on FPGA is designed and implemented. Hash address could be quickly computed to match the data， which was parallel processed using XOR Hash algorithm. Logical rules was updated on the basis of original invasion implement， and through preprocessing， mode cluster of conflict was separately matched in order to solve the conflict. The experimental results showed that the system throughput is 129Gbps， more than 35 times of the software method. The throughput of each million frequency is 0806Gbps. When the number of processing Snort rules are increased， the system throughput is almost not affected.

Key words: string matching, FPGA(fieldprogrammable gate array), intrusion detection, XOR Hash algorithm, Hash conflict

中图分类号: