NDLI: FTSE: the FNIP-like TCAM searching engine

Content Provider	IEEE Xplore Digital Library
Author	Rong-Tai Liu Chia-Nan Kao Hung-Shen Wu Ming-Chang Shih Nen-Fu Huang
Copyright Year	2005
Description	Author affiliation: BroadWeb Corp., Hsinchu, Taiwan (Rong-Tai Liu)
Abstract	As the Internet grows at a very rapid pace, so does the incidence of attack events and documented unlawful intrusions. The network intrusion detection systems (NIDSes) are designed to identify attacks against networks or a host that are invisible to firewalls, thus providing an additional layer of security. NIDSes detect and filter the malicious packets by inspecting packet payloads to find worm signatures. The payload inspection operation dominates the throughput of an NIDS since every byte of packet payload needs to be examined. At network speeds of 1 Gbps or above, it can be difficult to keep up with intrusion detection in software, and hardware systems or software with hardware assist are normally required. This paper presents FTSE, a ternary content addressable memory (TCAM) based pattern matching engine. In this paper we show how FTSE can be used effectively to perform string matching for thousands of strings at multiple-Gigabit speed. We also describe how FTSE can be implemented feasibly with an FPGA/ASIC, a 2.25 Mb TCAM, and a small SSRAM. Our analysis shows that this approach for string matching is very effective and the throughput of our design can achieve up to 8 Gbps for 2,085 snort rules.
Starting Page	863
Ending Page	868
File Size	107278
Page Count	6
File Format	PDF
ISBN	0769523730
ISSN	15301346
DOI	10.1109/ISCC.2005.75
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2005-06-27
Publisher Place	Spain
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Search engines Intrusion detection Payloads Throughput Software systems Hardware Internet Information filtering Information filters Inspection
Content Type	Text
Resource Type	Article
Subject	Signal Processing Mathematics Computer Networks and Communications Computer Science Applications Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Packet pre-filtering for network intrusion detection

Multi-pattern signature matching for hardware network intrusion detection systems

Detection of Web-based attacks through Markovian protocol parsing

A multi-gigabit rate deep packet inspection algorithm using TCAM

Empirical Study of a National-Scale Distributed Intrusion Detection System: Backbone-Level Filtering of HTML Responses in China

Policy based access control framework for large networks

Hash-AV: fast virus signature scanning by cache-resident filters

Self-addressable memory-based FSM: a scalable intrusion detection engine

Centralized and Distributed Intrusion Detection for Resource-Constrained Wireless SDN Networks

FTSE: the FNIP-like TCAM searching engine

Similar Documents

Packet pre-filtering for network intrusion detection

Multi-pattern signature matching for hardware network intrusion detection systems

Detection of Web-based attacks through Markovian protocol parsing

A multi-gigabit rate deep packet inspection algorithm using TCAM

Empirical Study of a National-Scale Distributed Intrusion Detection System: Backbone-Level Filtering of HTML Responses in China

Policy based access control framework for large networks

Hash-AV: fast virus signature scanning by cache-resident filters

Self-addressable memory-based FSM: a scalable intrusion detection engine

Centralized and Distributed Intrusion Detection for Resource-Constrained Wireless SDN Networks

FTSE: the FNIP-like TCAM searching engine