Highly Efficient String Matching Circuit for IDS with FPGA

Abstract

String matching circuits have been studied extensively for intrusion detection systems so far. An NFA-based string matching circuit, one of the works, has expandability of processing data width. However the resource requirement increases markedly, it was difficult to implement an NFA-based string matching circuit with whole the Snort 2.3.3 rule (35461 characters) that processes at 10 Gbps on a single FPGA. In this paper, the authors propose a highly efficient string matching circuit for FPGA. In our circuit, redundant AND-gates and states in the NFA are eliminated to reduce the resource requirement. Consequently, our circuit is reduced in the resources requirement by over 50% as compared with a previous NFA-based circuit, and the synthesis result shows that a string matching circuit that includes the whole Snort 2.3.3 rule can be implemented onto a single xc2vp-100-6 FPGA with throughput over 10 Gbps