Intrusion Detection Systems Based On Sopc Design And Realization

As the intrusion events on the Internet always happens,Computer networks' security is more and more concered by people.Intrusion Detections System(IDS) is borned under this background.IDS could initiatively find and assess threats that exist in the system,which is an improtant complementarity for firewall.The IDS using at present is usually based on software or Network Processors(NP),which could not statisfy the increasing speed of the computer networks.IDS needs to collect data and then match it with the feature database.The matching process is the bottle-neck of the whole IDS system's processing speed.Therefor,if the featrue matching process is accelarated by hardware,then the performance of the IDS system would be greatly improved,especially the processing speed.An SOPC(System On Programmable Chip) based architecture of the IDS system is proposed,which contains an software module running on the NiosII Processor and an hardware accelatrator.The software module uses protocol analysis tehnology to detect malicous information containing in the network layer or the transportation layer;the hardware accelaration module is composed of two subsidiary module:the head match module and the reguler expression match module.The head match module uses Tree-bit map algorithms and the regular expression match module uses NFAs (None-Deterministic Finite Automata).The proposed architecture is realized on Altera CycloneII FPGA and is tested on Altera DEII development board.The test result shows that the desinged system could correctly detect all malicous information hiding in the network data flow.The hardware accelarator's throughput speed is 1.6Gbps.Firstly the development backgroud of the IDS system,the basic theorys of IDS and the developing trend is briefly introduced;Secondly the Tree-bit map algorithms and the NFA sate-machine are introduced;Thirdly the hardware implementation of the accelarator and the software implementation is introduced;finally,the system's test result and analysis is proposed.