SBIR Phase I: Hardware Support for 10 Gbps Intrusion Detection

这个小型企业创新研究（SBIR）第一阶段研究项目解决了企业和政府组织对监控和保护其高速电子网络的需求。目前的网络入侵检测技术都是基于软件或网络处理器的，两者本质上都是串行的，无法满足10 Gbps网络的速度要求。拟议的研究旨在证明使用一种新的，大规模并行架构，专门为高速入侵检测的可行性。该项目的目标是采用现有的针对1 Gbps网络实现的入侵检测加速设计，并将其扩展到满足10 Gbps的要求。具体而言，本研究概述了一条路径：（1）确定实现10 Gbps吞吐量所需的适当架构扩展，（2）创建实际逻辑设计，以及（3）执行仿真以证明设计确实可以处理10 Gbps。预计研究将表明，该架构的扩展确实可以处理10 Gbps。最终的应用是在完整的入侵检测解决方案中部署硬件检测引擎，并使该解决方案能够在实时10 Gbps网络中运行。今天的网络仍然容易受到黑客、网络犯罪分子和网络恐怖分子的攻击。一种能够随着（1）签名数量和复杂性的增加以及（2）网络速度的增加而扩展的架构不仅需要满足当今的安全需求，而且还需要为未来的入侵检测和其他网络监控系统奠定基础。网络管理人员将能够在较短的时间内以较低的成本升级其网络的安全性。

This Small Business Innovation Research (SBIR) Phase Iresearch project addresses the need of business and government organizations to monitor and protect their high-speed electronic networks. Current network intrusion detection technologies are based on software or network processors, both of which are essentially serial in nature, and cannot meet the speed requirements of 10 Gbps networks. The proposed research intends to demonstrate the feasibility of using a novel, massively parallel architecture specifically designed for high-speed intrusion detection. The objective of this project is to take an existing intrusion detection acceleration design implemented for 1 Gbps network, and extend it to meet 10 Gbps requirements. Specifically, this research outlines a path to (1) determine the proper architecture extension needed to achieve 10 Gbps throughput, (2) create the actual logic design, and (3) perform simulation to prove that the design can indeed handle 10 Gbps. It is anticipated that the research will show that an extension of the architecture can indeed handle 10 Gbps. An eventual application is to deploy the hardware detection engine in a complete intrusion detection solution and enabling the solution to operate in a live 10 Gbps network.Today's networks are still vulnerable to hackers, cyber criminals, and cyber terrorists. An architecture which can scale with both (1) the increase in the number and complexity of signatures and (2) the increase in network speeds, is needed not only to meet today's security needs, but also to lay out the groundwork for future intrusion detection and other network surveillance systems. Network managers will be able to upgrade the security of their networks in a shorter period of time and at a lower cost.