Regular Expression Software Deceleration for Intrusion Detection Systems
Regular Expression Software Deceleration for Intrusion Detection Systems
复制标题
用于入侵检测系统的正则表达式软件减速
DOI：
10.1109/fpl.2006.311246
复制
发表时间：
2006
期刊：
影响因子：
--
通讯作者：
Hongkyun Jung
中科院分区：
文献类型：
--
作者：
Z. Baker;V. Prasanna;Hongkyun Jung
由于FPGA设备提供了更大更快的资源，网络安全应用中可重构硬件的使用最近取得了很大进展。正则表达式已经成为入侵检测系统必不可少的基本功能，但其实现往往在内存开销和时间性能方面代价高昂。这项工作提供了一个架构，可以将指数NFA到DFA的转换成本降低到许多表达式的线性增长。通过在自定义微控制器中处理基于正则表达式的规则的时序和集成，与仅使用dfa的解决方案相比，降低了内存成本并提高了功能。微控制器及其相关的DFA都在FPGA上实现。使用运行时可编程内存表存储模式和软件。这允许对正则表达式进行动态修改。本文介绍了正则表达式微控制器的设计细节及其与DFA状态机的集成。讨论了系统可以有效处理的表达式类型以及继续挑战社区的突出问题。
The use of reconfigurable hardware for network security applications has recently made great strides as FPGA devices have provided larger and faster resources. Regular expressions have become a necessary and basic capability of intrusion detection systems, but their implementation tends to be expensive in terms of memory cost and time performance. This work provides an architecture that reduces the exponential NFA to DFA conversion cost to a linear growth for many expressions. By handling the timing and integration of the regular expression-based rules in a custom microcontroller, the memory costs are reduced and the capabilities are increased over a DFA-only solution. Both the microcontroller and its associated DFA are implemented on the FPGA. The patterns and software are stored using run-time programmable memory tables. This allows on-the-fly modification to the regular expressions. This paper presents the design details of the regular expression microcontroller and its integration to the DFA state machines. The types of expressions that the system can handle efficiently are discussed as well as the outstanding problems that continue to challenge the community.