Sciweavers

Share
ANCS
2007
ACM

Compiling PCRE to FPGA for accelerating SNORT IDS

9 years 6 months ago
Compiling PCRE to FPGA for accelerating SNORT IDS
Deep Payload Inspection systems like SNORT and BRO utilize regular expression for their rules due to their high expressibility and compactness. The SNORT IDS system uses the PCRE Engine for regular expression matching on the payload. The software based PCRE Engine utilizes an NFA engine based on certain opcodes which are determined by the regular expression operators in a rule. Each rule in the SNORT ruleset is translated by PCRE compiler into an unique regular expression engine. Since the software based PCRE engine can match the payload with a single regular expression at a time, and needs to do so for multiple rules in the ruleset, the throughput of the SNORT IDS system dwindles as each packet is processed through a multitude of regular expressions. In this paper we detail our implementation of hardware based regular expression engines for the SNORT IDS by transforming the PCRE opcodes generated by the PCRE compiler from SNORT regular expression rules. Our compiler generates VHDL co...
Abhishek Mitra, Walid A. Najjar, Laxmi N. Bhuyan
Added 12 Aug 2010
Updated 12 Aug 2010
Type Conference
Year 2007
Where ANCS
Authors Abhishek Mitra, Walid A. Najjar, Laxmi N. Bhuyan
Comments (0)
books