11

FPGA-Based Intrusion Detection System for 10

Gigabit Ethernet

Authors: Toshihiro KATASHITA, Yoshinori YAMAGUCHI, Atusi MAEDA,and Kenji TODA

Publisher: IEICE TRANS. INF. & SYST 2007

Present: Kai-Tso Chang Date: Jul 8 2008

2

Architecture of the IDS circuit

3

Detail of Step (4)

4

Procedure for generating the IDS circuit

5

NFA

The NFA-based method reduces the resource utilization of the circuit without reducing its performance by sharing redundant states and state transition conditions (STCs).

6

Example of sharing duplicative states

7

Generating the string matching circuit

8

Generating the string matching circuit

9

Generating the string matching circuit

10

Decoder NFA

11

Composition of the IDS

12

Results of IDS circuit implementation

13

IDS structure to support online-rule update

14

Procedure for online-rule update in the IDS

15

Support large rule set