String alignment pre-detection using unique subsequences for FPGA-based network intrusion detection

Abstract

In this work, we propose a multi-character hardware-based solution using non-deterministic finite automata, NFA, for network intrusion detection. Our approach uses unique subsequence matching. This is a real-time preprocessing phase for detecting the possible presence and the corresponding alignment of the string in the data flow. In doing so, we make a reduction of the area cost for processing multiples characters. Instead of replicating the hardware by splitting the NFAs for each string alignment regarding the block of characters accepted at each cycle, we arrange the NFAs input so they match with the correct string alignment. The architecture is fully pipelined in order to reduce the latency. Taking four characters at the input we achieve multi gigabits throughputs, at the time that thousands of strings can be matched.