Efficient packet matching for gigabit network intrusion detection using TCAMs

Abstract

Ternary content-addressable memories (TCAMs) have gained wide acceptance in the industry for storing and searching patterns in routers. But two important problems block the way to deploy TCAMs as deep package matching engines for network intrusion detection systems (NIDS): long patterns matching and range patterns matching. A novel high speed long patterns matching architecture using cascade TCAMs for large signature set based NIDS is presented in this paper. Systems to handle tens of thousands of signatures with thousands of bytes length each can be built on such architecture. A novel efficient header rules matching system is proposed in this paper. This scheme offloads the range matching task to efficient specialized comparing engines in FPGAs so that it soIves the range matching problem with high throughout performance, about 250 million packets per second (Mpps) theoretically.