Abstract: In the intrusion detection system， due to processor’s performance and serial execution， the processing speed of softwarebased string matching system is limited. ASICbased string matching system can provide high throughputs， but its pattern strings is difficult to update. In order to improve processing speed and adapt to the detection rules’ update， a string matching system based on FPGA is designed and implemented. Hash address could be quickly computed to match the data， which was parallel processed using XOR Hash algorithm. Logical rules was updated on the basis of original invasion implement， and through preprocessing， mode cluster of conflict was separately matched in order to solve the conflict. The experimental results showed that the system throughput is 129Gbps， more than 35 times of the software method. The throughput of each million frequency is 0806Gbps. When the number of processing Snort rules are increased， the system throughput is almost not affected.

Key words: string matching, FPGA(fieldprogrammable gate array), intrusion detection, XOR Hash algorithm, Hash conflict