Abstract Intrusion Detection Systems (IDSs) rely on pattern matching to detect and thwart a network attack by comparing packets with a database of known attack patterns. The key requirements of trusted intrusion detection are accurate pattern matching, adaptive, and reliable reconfiguration for new patterns. To address these requirements, this paper presents a trusted intrusion detection by utilizing hybrid pattern matching engines: FPGA‐based and multicore‐based pattern matching engine. To achieve synchronization of these two pattern matching engines, methodologies including multi‐threading DFA and clustered state coding have been developed. These hybrid pattern matching engines increases the reliability and trustworthy of intrusion detection systems. Copyright © 2009 John Wiley & Sons, Ltd.

Abstract Multicore based network processors are promising components to build real‐time and scalable security systems to protect the networks and systems. The parallel nature of the processing system makes it challenging for application developers to concurrently program security systems for high performance. In this paper we present an automatic programming methodology that considers application complexity, traffic variation, and attack signatures update. In particular, our mapping algorithm concurrently takes advantage of parallelism in the level of tasks, applications, and packets to achieve optimal performance. We present results that show the effectiveness of the analysis, mapping, and the performance of the model methodology. Copyright © 2009 John Wiley & Sons, Ltd.

The Internet is suffering caused by the lacking of security. One of the most promising ways to provide security is Intrusion Detection Systems (IDSs). The heart of almost every IDSs is a string matching algorithm, which is a very computational intensive task. Network Processors (NPs), a specialized multiprocessor, can provide flexibility and high performance for string matching. This paper evaluates several key string matching algorithms using a comprehensive simulation framework. Starting from a uniprocessor profiling, the framework constructs task graphs for string matching algorithms. Then task graphs are mapped onto NPs together with other network applications. The system throughput is determined by the analytical performance model. With this framework, we can evaluate the performance of different string matching algorithms on NPs. Our results show that shift table based algorithms (SFKSearch and Wu-Manber) and finite automaton based Aho-Corasick are complementary: SFKSearch and Wu-Manber do better job in NPs for good packet and larger pattern length due to better inter-task parallelism and shifting; Aho-Corasick does not depend on minimal pattern length and shows relative small processing cost variation between bad and good packets.

Network Processors (NPs) are embedded system-on-a-chip multiprocessors that are optimized to perform simple packet processing tasks at data rates of several Gigabytes per second. They are the key components to build a performance-scalable and function-flexible network systems. To meet the performance demands of increasing link speeds and more complex network applications, NPs are implemented with several dozen of processor cores and run multiple packet processing applications in parallel. This trend makes it increasingly difficult for application developers to program NPs for high performance. This paper presents an automated task scheduling technique to address this parallel programming complexity. Our proposed technique is based on GA. By incorporating tasks dependency into scheduling list and encoding task scheduling list as a chromosome, GA can quickly remove the invalid mappings and evolve to the high quality solutions. This technique takes advantage of task-level and application-level parallelism to maximize system performance for a given NPs architecture. The simulation results show that this proposed technique can generate high quality mapping comparing to other heuristics by mapping some sample network applications. This work will also enable researchers and engineers to systematically evaluate and quantitatively understand the NPs system issues including application partitioning, architecture organizing, workload mapping and run-time operating.

This paper presents a string matching hardware on FPGA for network intrusion detection systems. The proposed architecture, consisting of packet classifiers and strings matching verifiers, achieves superb throughput by using several mechanisms. First, based on incoming packet contents, the packet classifiers can dramatically reduce the number of strings to be matched for each packet and, accordingly, feed the packet to a proper verifier to conduct matching. Second, a novel multi-threading finite state machine (FSM) is proposed, which improves FSM clock frequency and allows multiple packets to be examined by a single FSM simultaneously. Design techniques for high-speed interconnect and interface circuits are also presented. Experimental results are presented to explore the trade-offs between system performance, strings partition granularity and hardware resource cost

Pattern matching has been one of the major operations in modern bioengineering especially in Bioinformatics. Prior work on this area have focus on either pursuing mathematically efficient matching algorithms or hardwired approach. As multicore processor are becoming mainstream, developers need to determine how to take advantage of multicore technology for pattern matching. In this paper, we propose a methodology to evaluate pattern search algorithms for DNA on Multiprocessor. Our evaluation methodology is an automatic simulation framework. Starting from a uniprocessor profiling, the framework constructs task graphs for string matching algorithms. Then task graphs are mapped onto multiprocessor. The system's performance is determined by the analytical performance model. With this framework, we can evaluate the performance of different algorithms on multiprocessor. Our case studies show that finite automaton based (Aho-Corasick) is more efficient than shift table based algorithms (SFKSearch and Wu-Manber) on uniprocessor, however, Wu-Manber is 3 times efficient than Aho-Corasick on multiprocessor due to its inherent parallelism.