FPGA based network intrusion detection system

Abstract

A Network Intrusion Detection System NIDS monitors a network for malicious activity The devices connected to internet are vulnerable to virus attacks spams Trojan horses Denial of Service DoS attack etc A firewall blocks unauthorized access to the network by checking MAC address/ IP address/ port number present in the header of a data packet But the NIDS checks the entire packet including header and payload. The NIDS can be classified as hardware NIDS and software NIDS The software NIDS are not able to meet the high speed of the today s networks and vulnerable to be compromised by hackers. But the hardware NIDS are not vulnerable to malware attacks. Moreover hardware NIDS is scalable to the growing demand of the networks and reliable Typically a NIDS includes two modules a signature matching module and an anomaly detection module The signature matching module identifies the existing viruses and it needs constant update The anomaly detection module can identify unknown or new malwares Hence the proposed system has been designed as a combination of both signature matching and anomaly detection Moreover the proposed method is implemented in FPGA hardware to provide reconfigurability speed and scalability requirements of the hardware based NIDS newlineThe main challenge associated with the signature matching system is the extreme power consumption due to intensive data comparison and memory space The extreme power consumption due to Content Addressable Memory CAM and hash based comparisons are replaced with a Lookup table based binary search Here a set of known signatures are compiled into merged Finite State machine FSM and the number of outgoing edges associated with the nodes of the FSM are used to construct the Lookup table The power consumed by the entire signature matching module is 27.44 mW newline newline