SBIR Phase II: Hardware Support for 10 Gbps Intrusion Detection

这个小型企业创新研究（SBIR）第二阶段项目将通过利用应用于高速入侵检测和防御系统（IDPS）硬件的多指令单数据（MISD）处理模型，极大地推进性能突破。MISD处理模型的多芯片实现将进一步展示该技术的可扩展性和成本效益，将IDPS处理能力提高到一定水平，同时降低现有系统的成本。当前的线路速度状态计算受到当前可用内容可寻址存储器的成本和可伸缩性的限制。源自内存缓存架构的思想将被用于构建一个新的内存子系统，专门设计用于经济有效地支持关键的、有状态的、10gbps的安全应用程序，如TCP流重组和协议规范化。最后，开源接口的开发将把这些创新的使用扩展到一个大的用户社区，他们肯定会通过组织间的协作努力为IDPS技术的进步做出贡献。下一代应用需要高速网络连接。例如，超级计算机集群、医疗图像传输、数据存储网络、视频会议和远程呈现应用程序都需要10千兆位或更高的速度。不幸的是，公共和私人通信基础设施目前正受到安全妥协的破坏。网络病毒、蠕虫和其他攻击可以在Internet和专用网络上迅速传播，使商业瘫痪，并导致严重的生产力损失。检测和防止这些攻击通过高速链路传播的能力是促进跨组织边界采用这些攻击的关键要求。如果没有适当的入侵检测和防御，高速链路将在信息系统中引入严重的攻击，并限制高带宽下一代应用的商业可行性和深远效益。该二期项目将显著提高高速IDPS技术的成本效益、开放性和可扩展性。这将促进更广泛地利用组织间高速互联互通，并影响社会、经济和教育进步。

This Small Business Innovation Research (SBIR) Phase II project will dramatically advance performance breakthroughs achieved by utilizing a Multiple Instruction Single Data (MISD) processing model applied to high-speed Intrusion Detection and Prevention System (IDPS) hardware. A multiple-chip implementation of the MISD processing model will further demonstrate the scalability and cost-effectiveness of the technology by increasing IDPS processing capacity to levels while reducing costs for the existing system. Current line speed stateful computations are limited by the cost and scalability of currently available content addressable memories. Ideas derived from memory caching architectures will be adapted to build a novel memory subsystem specifically designed to cost-effectively support critical, stateful, 10 Gbps security applications such as TCP stream reassembly and protocol normalization. Finally, the development of open-source interfaces will extend the use of these innovations to a large community of users who will certainly contribute to the advancement of IDPS technology through inter-organizational collaborative efforts.Next-generation applications require high-speed network connectivity. For example, supercomputer clustering, medical image delivery, data storage networking, video conferencing, and tele-presence applications all need 10 Gigabit and higher speeds. Unfortunately, public and private communication infrastructures are today being destabilized by security compromises. Network viruses, worms and other attacks can propagate very quickly over the Internet and private networks, disabling commerce and resulting in significant productivity loss. The ability to detect and prevent these attacks from traveling through high speed links is a crucial requirement for fostering their adoption across organizational boundaries. Without proper intrusion detection and prevention, high speed links will introduce severe attacks in information systems and limit the commercial viability and far-reaching benefits of high bandwidth, next-generation applications. This Phase II project will dramatically improve the cost-effectiveness, openness and scalability of high-speed IDPS technology. This will facilitate a broader use of inter-organizational, high-speed connectivity and impact social, economic and educational progress.