Abstract
Network intrusion detection systems (NIDS) are widely deployed in the past years. The performance of signature-based NIDS depends on the employed string matching algorithms to matching the incoming packets with the pre-defined signature database. Software-based implementation of pattern matching algorithm offers the advantage of flexibility but suffers from the performance problem, especially for the gigabit rate environment. In this thesis, a ternary content addressable memory (TCAM) and binary CAM (BCAM) based preprocessor architecture to accelerate the signature matching is proposed. TCAMs are fully associative memories that allow a “don’t care” state to be stored in each memory cell in addition to 0s and 1s. The prefix of signatures (rules) are structured carefully and stored in BCAM/TCAM. When a packet comes, each BCAM/TCAM entry is looked up in parallel. All packets will be scanned in two pipeline stages. In stage 1, packets are scanned using BCAM/TCAM very fast to indicate where the possible attack codes occur. In stage 2, the system will identify if the attack code truly exists. The performance analysis of the proposed mechanism is also provided, and from the analysis, the proposed architecture can operate at multi-gigabit rate.