Shigenori Tomiyama

Applying Cuckoo Hashing for FPGA-based Pattern Matching in NIDS/NIPS

Pattern matching for network intrusion/prevention detection requires extremely high throughput with frequent updates to support new attack patterns. Most of current hardware implementations have outstanding performance over software implementations. However, the requirement for dynamic update pattern set is still challenging for hardware researchers. This paper describes a novel FPGA-based pattern matching architecture using a recent hashing algorithm called Cuckoo Hashing. The proposed architecture features on-the-fly pattern updates without reconfiguration, more efficient hardware utilization, and higher performance. Through various algorithmic changes of Cuckoo Hashing, we can implement parallel pattern matching on SRAM-based FPGA. Our system can accommodate the latest Snort rule-set, an open source network intrusion detection/prevention system, and achieve the highest utilization in terms of SRAM per character and logic cells per character at 17 bits/character and 0.043 logic cells/character, respectively on major Xilinx Virtex architectures. Compared to others, ours is much more efficient than any other Xilinx FPGA architectures.

A technique to truncate IIR filter impulse response and its application to real-time implementation of linear-phase IIR filters

A technique for realizing linear-phase infinite impulse response (IIR) filters has been proposed by Powell and Chau (1991) and gives a real-time implementation of H(z/sup -1/)/spl middot/H(z), where H(z) is a causal IIR filter function. In their system, the input signal is divided into L-sample sections, time-reversed, section convolved with H(z), and time-reversed again. The signal is then filtered by H(z) to give the system output with a processing delay of 3L+1 samples. However, the group delay response of the system exhibits a minor sinusoidal variation superimposed on some constant value. This variation will degrade image quality in image processing and signal quality in signal transmission applications. Furthermore, the output of the system contains harmonic distortion for a sinusoidal input. The main drawbacks of Powell and Chaus technique are the large processing delay of 3L+1 samples and the accompanying phase and harmonic distortions. A smaller processing delay increases the phase and harmonic distortions, yet the amplitude response remains acceptable. Previously, the present authors presented a method of reducing the processing delay by shortening the section length by an integer factor N using a structure with increased number of paths for the time-reversed signal. The authors consider how to reduce the phase and harmonic distortions. We examined the operation of the sectioned convolution and analyzed it based on a state-space representation. Then, we found that the cause of the distortions is a periodic variation of the impulse response length in the sectioned convolution. To overcome this problem, a technique is devised to realize a recursive circuit having a truncated impulse response with a fixed-length L. A system applying this technique to the Powell-Chau system is demonstrated to exhibit perfect linear-phase characteristic and produce virtually no harmonic distortion. Therefore, the section length L can be reduced without limitation due to phase and harmonic distortions. Two methods for reducing the increased computational complexity of this technique assuming fixed L are developed, and simulations are performed for the proposed system to confirm the expected improvements.

Optimization of Regular Expression Processing Circuits for NIDS on FPGA

Recent Network Intrusion Detection System (NIDS) utilizes more and more Regular Expression to describe malicious patterns existing in the content payload of packets. Many researches are investigated and several techniques are introduced to optimize performance and support all functions of regular expression on hardware platform. However there is very few researches in the minimization of multiple regular expressions. This paper takes in account of compiling multiple regular expressions with respect to optimize hardware resources. We take advantage of block memory to implement character matching and present a novel sharing architecture which completely supports sharing common parts among given set of regular expressions. Experimental results show that our optimization can reduce 46% area circuits compared with previous approaches and achieve throughput of 1.5-2.1 Gbps on Snort malicious database.

Sample delay reduction of linear phase IIR filters by shortening section length of signals

A technique for realizing linear phase IIR filters has been proposed by Powell and Chau. This technique contains a real-time realization of a noncausal transfer function using the following three procedures. 1) Approximate the IIR filters impulse response to a finite length L. 2) Divide the input and output signal sequences of the IIR filter by this length L and perform a time reversal operation at each section in real time. 3) Realize a time-adjusted overlap-add for the divided section with length L by means of a two-path IIR filter. However, in 2), an L-sample delay is generated at each signal section, and in 3), an L + 1-sample delay is generated. Hence, in the entire system, a 3L + 1–sample delay is generated. In this article, the delay in 2) is discussed. It is shown that the delay in the system can be reduced by shortening the divided section length L of the signal sequence to 1 over an integer (shortened section length is also an integer).

Memory-efficient signature matching for ClamAV on FPGA

Signature matching is a crucial task of various security applications such as antiviruses, intrusion detections, and firewalls. The growth in quantity and complexity of signatures made matching task more challenge especially on general purpose processor. In this paper, we proposed an efficient architecture for matching Clam Antivirus (ClamAV) signatures on FPGA. We utilize Bloom filter technique for filtering input data and Bloomier filter technique for one round check suspect data. Our matching engine support up to 256 byte length signature and can handle both basic and regular expression signatures. Compare to previous approaches, our architecture is better memory utilization with 14%-64% less than previous works. Experiences on low-cost Altera Cyclone II show that our system can fit signature set with more than 43K characters size and is capable of 1 gigabit per second throughput.

Manifold similarity search of DNA sequences with reconfigurable hardware

This paper presents a reconfigurable processor array for the similarity search of up to sixteen DNA query sequences against a large database. Based on the recently proposed space-time mapping methodology, the processor array is implemented using a Xilinx Virtex-4 XC4VLX60 FPGA on the AVNet ADS-XLX-V4-LX-EVL60 board. The proposed system can sustain a high computation throughput rate with lower data transfer speed from the host database than others up to sixteen folds via a USB 2.0 interface.

Extrapolation for compressed coefficient's band-pass delay time characteristics by using genetic-algorithm on the DCT

We use the Fourier series algorithm to design a filter, but we do not use the window functions. Instead of this, we use the genetic algorithm (GA) on the discrete cosine transform (DCT) of a given band-pass characteristics. For the attenuation characteristics, we have already mentioned this procedure, so we only mention the delay time characteristics. This papers method is useful for an ASIC equalizer (filter) design through a reduction of the number of coefficients. An example shows that the proposed method can reduce the high order Fourier coefficients by a half for a given band-pass characteristic. These coefficients are compressed in half.