论文标题
高效的Wu-Manber模式匹配用于入侵和恶意软件检测的硬件
Efficient Wu-Manber Pattern Matching Hardware for Intrusion and Malware Detection
论文作者
论文摘要
网络入侵检测系统和防病毒软件对于检测恶意网络流量以及诸如拒绝服务和恶意的攻击至关重要。每种攻击，蠕虫或病毒都有其独特的签名。基于签名的入侵检测和防病毒系统取决于模式匹配，以寻找可能的攻击特征。模式匹配是一项非常复杂的任务，需要大量时间，内存和计算资源。基于软件的入侵检测不足以匹配高网络速度和越来越多的攻击。在本文中，我们建议使用匹配算法的Wu-Manber图案的特殊用途硬件。 FPGA构成了一个绝佳的选择，因为它们的平行结构，可重编程的逻辑和内存资源。该硬件是在Verilog设计的，并使用Xilinx ISE实施。为了进行评估，我们使用Wireshark收集的2500个签名从Clamav病毒定义数据库中收集的交通轨迹。实验结果表明，高速最高可达216 Mbps。此外，我们评估了时间，设备的使用和功耗。
Network intrusion detection systems and antivirus software are essential in detecting malicious network traffic and attacks such as denial-of-service and malwares. Each attack, worm or virus has its own distinctive signature. Signature-based intrusion detection and antivirus systems depend on pattern matching to look for possible attack signatures. Pattern matching is a very complex task, which requires a lot of time, memory and computing resources. Software-based intrusion detection is not fast enough to match high network speeds and the increasing number of attacks. In this paper, we propose special purpose hardware for Wu-Manber pattern matching algorithm. FPGAs form an excellent choice because of their massively parallel structure, reprogrammable logic and memory resources. The hardware is designed in Verilog and implemented using Xilinx ISE. For evaluation, we dope network traffic traces collected using Wireshark with 2500 signatures from the ClamAV virus definitions database. Experimental results show high speed that reaches up to 216 Mbps. In addition, we evaluate time, device usage, and power consumption.
