N. Sertac Artan

TriBiCa: Trie Bitmap Content Analyzer for High-Speed Network Intrusion Detection

Deep packet inspection (DPI) is often used in network intrusion detection and prevention systems (NIDPS), where incoming packet payloads are compared against known attack signatures. Processing every single byte in the incoming packet payload has a very stringent time constraint, e.g., 200 ps for a 40-Gbps line. Traditional DPI systems either need a large memory space or use special memory such as ternary content addressable memory (TCAM), limiting parallelism, or yielding high cost/power consumption. In this paper, we present a highspeed, single-chip DPI scheme that is scalable and configurable through memory updates. The scheme is based on a novel data structure called TriBiCa (trie bitmap content analyzer), which provides minimal perfect hashing functionality. It uses a trie structure with a hash function performed at each layer. Branching is determined by the hashing results with an objective to evenly partition attack signatures into multiple groups at each layer. During a query, as an input traverses the trie, an address to a table in the memory that stores all attack signatures is formed and is used to access the signature for an exact match. Due to the small space required, multiple copies of TriBiCa can be implemented on a single chip to perform pipelining and parallelism simultaneously, thus achieving high throughput. We have designed the TriBiCa on a modest FPGA chip, Xilinx Virtex II Pro, achieving 10-Gbps throughput without using any external memory. A proof-of-concept design is implemented and tested with 1-Gbps packet streams. By using todays state-of-the-art FPGAs, a throughput of 40 Gbps is believed to be achievable.

FlashLook: 100-Gbps hash-tuned route lookup architecture

Since the recent increase in the popularity of services that require high bandwidth, such as high-quality video and voice traffic, the need for 100-Gbps equipment has become a reality. In particular, next generation routers are needed to support 100-Gbps worst-case IP lookup throughput for large IPv4 and IPv6 routing tables, while keeping the cost and power consumption low. It is challenging for todays state-of-the-art IP lookup schemes to satisfy all of these requirements. In this paper, we propose FlashLook, a low-cost, high-speed route lookup architecture scalable to large routing tables. FlashLook allows the use of low-cost DRAMs, while achieving high throughput. Traditionally, DRAMs are not known for their high throughput due to their high latency. However, FlashLook architecture achieves high-throughput with DRAMs by using the DRAM bursts efficiently to hide DRAM latency. FlashLook has a data structure that can be evenly partitioned into DRAM banks, a novel hash method, HashTune to smooth the hash table distribution and a data compaction method called verify bit aggregation to reduce memory usage of the hash table. These features of the FlashLook results in better DRAM memory utilization and less number of DRAM accesses per lookup. FlashLook achieves 100-Gbps worst-case throughput while simultaneously supporting 2M prefixes for IPv4 and 256k prefixes for IPv6 using one FPGA and 9 DRAM chips. FlashLook provides fast real-time updates that can support updates according to real update statistics.

Aggregated Bloom Filters for Intrusion Detection and Prevention Hardware

Bloom Filters (BFs) are fundamental building blocks in various network security applications, where packets from high-speed links are processed using state-of-the-art hardware- based systems. In this paper, we propose Aggregated Bloom Filters (ABFs) to increase the throughput and scalability of BFs. The proposed ABF has two methods to improve average speed and scalability. The first method leverages the query mechanism for hardware BFs. We optimize queries by removing redundant hash calculations and memory accesses. First, to remove redundancy, the hash functions for each query are calculated sequentially. As soon as we have a no match in any of the hash results, the query is immediately abandoned. We then aggregate multiple queries and query a BF with all of these queries in parallel, which maximizes the throughput of the BF. The second method addresses scalability issues regarding the on-chip memory resources. In most applications multiple BFs are required to store many sets with different numbers of elements. These sets may also be too small for the unit memory on-chip. So, most of the memory is left unused, causing low memory utilization. The second method aggregates small distributed BFs to a single BF allowing better on-chip memory utilization. For the application of Network Intrusion Detection and Prevention Systems (NIDPSs), our proposed ABF shows seven-fold improvement in the average query throughput and four times less memory usage.

LaFA : lookahead finite automata for scalable regular expression detection

Although Regular Expressions (RegExes) have been widely used in network security applications, their inherent complexity often limits the total number of RegExes that can be detected using a single chip for a reasonable throughput. This limit on the number of RegExes impairs the scalability of todays RegEx detection systems. The scalability of existing schemes is generally limited by the traditional per character state processing and state transition detection paradigm. The main focus of existing schemes is in optimizing the number of states and the required transitions, but not the suboptimal character-based detection method. Furthermore, the potential benefits of reduced number of operations and states using out-of-sequence detection methods have not been explored. In this paper, we propose Looka-head Finite Automata (LaFA) to perform scalable RegEx detection using very small amount of memory. LaFAs memory requirement is very small due to the following three areas of effort described in this paper: (1) Different parts of a RegEx, namely RegEx components, are detected using different detectors, each of which is specialized and optimized for the detection of a certain RegEx component. (2) We systematically reorder the RegEx component detection sequence, which provides us with new possibilities for memory optimization. (3) Many redundant states in classical finite automata are identified and eliminated in LaFA. Our simulations show that LaFA requires an order of magnitude less memory compared to todays state-of-the-art RegEx detection systems. A single commodity Field Programmable Gate Array (FPGA) chip can accommodate up to twenty-five thousand (25k) RegExes. Based on the throughput of our LaFA prototype on FPGA, we estimated that a 34-Gbps throughput can be achieved.

Spatiotemporal compression for efficient storage and transmission of high-resolution electrocorticography data

High-resolution Electrocorticography (HR-ECoG) has emerged as a key strategic technology for recording localized neural activity with high temporal and spatial resolution with potential applications in brain-computer interfaces (BCI), and seizure detection for epilepsy. However, HR-ECoG has 400 times the resolution of conventional ECoG, making it a challenge to process, transmit and store the HR-ECoG data. Therefore, simple and efficient compression algorithms are vital for the feasibility of implantable wireless medical devices for HR-ECoG recordings. In this paper, following the observation that HR-ECoG signals have both high spatial and temporal correlations similar to video/image signals, various compression methods suitable for video/image- compression based on motion estimation, discrete cosine transform (DCT) and discrete wavelet transform (DWT)- are investigated for compressing HR-ECoG data. We first simplify these methods to satisfy the low-power requirements for implantable devices. Then, we demonstrate that spatiotemporal compression methods produce up to 46% more data reduction on HR-ECoG data than compression methods using only spatial compression do. We further show that this data reduction can be achieved with low hardware complexity. In particular, among the methods investigated, spatiotemporal compression using DCT-based methods provide the best trade-off between hardware complexity and compression performance, and thus we conclude that DCT-based compression is a promising solution for ultralow-power implantable devices for HR-ECoG.

A high-performance transcutaneous battery charger for medical implants

As new functionality is added to the implantable devices, their power requirements also increase. Such power requirements make it hard for keeping such implants operational for long periods by non-rechargeable batteries. This result in a need for frequent surgeries to replace these batteries. Rechargeable batteries can satisfy the long-term power requirements of these new functions. To minimize the discomfort to the patients, the recharging of the batteries should be as infrequent as possible. Traditional battery charging methods have low battery charging efficiency. This means they may limit the amount of charge that can be delivered to the device, speeding up the depletion of the battery and forcing frequent recharging. In this paper, we evaluate the suitability of a state-of-the-art general purpose charging method called current-pumped battery charger (CPBC) for implant applications. Using off-the-shelf components and with minimum optimization, we prototyped a proof-of-concept transcutaenous battery charger based on CPBC and show that the CPBC can charge a 100 mAh battery transcutaneously within 137 minutes with at most 2.1°C increase in tissue temperature even with a misalignment of 1.3 cm in between the coils, while keeping the battery charging efficiency at 85%.

Range hash for regular expression pre-filtering

Recently, major Internet carriers and vendors successfully tested high-speed backbone networks at 100-Gbps line speed to support rapid growth of the Internet traffic demands. In addition, traffic is getting more concentrated to points such as data centers, and demand for protecting such high-speed networks from attack traffic is increasing. Deep Packet Inspection (DPI) with Regular Expression (RegEx) detection is the de facto defense mechanism agains network intrusions. However, current RegEx detection systems cannot keep up with the upcoming high-speed line rate. The RegExes consist of three types of components, exact strings, character classes (CC), and repetitions. Exact string and repetition matching have been widely studied by RegEx research community for better performance. Yet, although more than 55% of RegExes in Snort signature set contain at least one CC, hardware based solutions that focus on CC detection is limited. In this paper we propose a new CC detection architecture called Range Hash that is suitable for high-speed, compact CC detection. Additionally, we propose a practical application of the Range Hash architecture where it can be used as a pre-filter for a Regular Expression detection system to increase overall RegEx detection performance. Based on our hardware prototype design which runs at 250MHz, Range Hash can reach to 100-Gbps CC detection throughput with todays FPGA chips.

Optimizing analog-to-digital converters for sampling extracellular potentials

In neural implants, an analog-to-digital converter (ADC) provides the delicate interface between the analog signals generated by neurological processes and the digital signal processor that is tasked to interpret these signals for instance for epileptic seizure detection or limb control. In this paper, we propose a low-power ADC architecture for neural implants that process extracellular potentials. The proposed architecture uses the spike detector that is readily available on most of these implants in a closed-loop with an ADC. The spike detector determines whether the current input signal is part of a spike or it is part of noise to adaptively determine the instantaneous sampling rate of the ADC. The proposed architecture can reduce the power consumption of a traditional ADC by 62% when sampling extracellular potentials without any significant impact on spike detection accuracy.

A signal-specific approach for reducing SAR-ADC power consumption

A novel power optimization technique, called adaptive tracking is proposed in this paper for successive approximation analog-to-digital converters aiming implantable device applications. A SAR-ADC can easily be equipped with the proposed tracking technique by a minor modification in its digital circuitry (SAR). This work relies on the similarity of consecutive sample values in band-limited bio-potentials. The proposed adaptive tracking scheme can reduce power consumption of a wide variety of SAR-ADCs. In particular, we show that the tracking scheme can save 30% of power in a conventional SAR-ADC, 31% of power in those using binary SAR-ADCs using a weighted DAC with split MSB capacitor, and 8% of power in those using charge sharing DAC.

Multi-layer coils for efficient Transcutaneous Power Transfer

TETS (Transcutaneous Energy Transfer System) has been successfully used for powering medical implants for different purposes such as for neural recordings and drug delivery. Yet, due to their low power transfer efficiency, these devices can cause unacceptable increase in skin temperature limiting their scalability to high power levels. Although, the efficiency of these systems can be improved by increasing coil diameter, in many cases this is not practical due to strict physical constraints on the coil diameter. In this paper, we investigate using multi-layer coils as secondary coils in the TETS to increase the power transfer efficiency, and thus allowing the delivery of the desired power safely for a longer period. Our experiments show a 5× increase in the duration of safe power delivery (not increasing the skin temperature more than 2 C) using multi-layer coils as the secondary coil compared to using single-layer coils even when there is a 50% misalignment in between primary and secondary coils. This increase in duration of safe power transfer is shown to be over 16× more when the coils are aligned. The improvement in the duration of safe power transfer is achieved without increasing the coil diameter and with a coil thickness of 2 mm.