| With the increasing risks of the network security, various network security defense technologies have been developed rapidly. As a a novel protection technology succeeding the traditional measures such as Firewall, AntiVirus etc., Intrusion Detection System(IDS) has become an important subject in the field of network security and has been gradually applied to all kinds of high security requirements environments, for monitoring, detecting and responding comprehensively all the network intrusion behaviours.At present, pattern matching technology, due to its high accuracy of inspection, low false rate and high practicability, has been widely used and has become the core technology of the intrusion detection system. But with the development of network technology, the scale, speed and application of network keep developing and promoting. Meanwhile the amount of the network security risks and its changing frequency also increase in multiples of geometry accordingly. All these have brought great challenge to model matching speed and capacity of IDS. In order to improve its performance and to avoid missing matching and fault matching owing to the overloading matching pressure, developing and designing hardware IDS which use high-speed hardware pattern matching technology to replace the traditional software matching has become a main trend.In view of the above, this paper targeting improving the pattern matching capacity and speed of IDS makes a research from following aspects respectively.Firstly, through the analysis of various typical string matching algorithms, the AC algorithm has been improved and optimized, and a new fast AC algorithm (FAC) has been designed and realized using FPGA. Secondly, the paper carries out a detailed analysis and research on regular expression pattern matching which is wide used in IDS, then a complete regular expression pattern matching system has realized. Finally, using processor, FPGA,.external storage and other devices, a complete hardware intrusion detection system has been developed, and utilizing this system FAC algorithm and regular expressions pattern matching have been validated and tested. The test results show that comparing the software intrusion detection system, the hardware intrusion detection system developed in this paper has obvious advantage in processing speed and system capacity. |
