Abstract
Given the complexity of the Internet connectivity involved, signature-based NIDS (Network Intrusion Detection System) can not rely only on the use of one payload string, regular expression and URL to detect attack intension. A highly recognizable signature must be included in the basis of this particular relationship. For example, with HTTP flow, when the content “GET ” appears on the fourth byte of the payload and then the URL “/../../../../../../../../../../../” appears, this activates that the detect attack intension “WEB-MISC DOS attempt.” These are called “multi-event rules.” Under the public open-source of NIDS - Snort, the number of multi-events in the total number of rules increases depending on the version update. Because the original Snort program is a pure software system, the “Detection Engine” must search the entire option node (conditions) under the entire sequential RTN list. Under multi-event rules, the general trend is for the ‘Detection Engine’ to become the time-critical component of the Snort system. The objective of this thesis is to attempt to improve the original NIDS using three approaches. The first objective is to observe target patterns with a specified network application. To do this, we modify an AC multi-pattern match algorithm to filter 60~70% of unnecessary pattern information, which substantially reduces the amount of post-processor overhead. The second objective is to divide the Snort rule set into several groups. Each event needs only to search the corresponding independent rule group. Therefore, narrowing the search range can reduce the frequency of matching numbers. Lastly, this thesis proposes a novel architecture to re-plan components of the Snort detection engine. We see that a SoC-based solution is better because it looks after both programmable software and the logic circuits of specific hardware. We devise a SoC system, which incorporates the above three objectives, on an Altera FPGA development board (1C20). This SoC-based system is shown to detect all attack intentions correctly. Furthermore, according to latency observations in three networks, the speed of the SoC-based approach is 8 to 14 times faster than a pure software system.