FPGA Based Network Security architecture for High Speed Networks

5.2 Basic Idea and Related work
and the basic ideas of NIDS which is followed by our proposed string matching
algorithm using Bloom filters. Two scenarios are further discussed on the con-
text of the length of the input packet and the multiple length patterns. Finally
the implementation details and analysis are discussed which is followed by the
conclusion.
5.2 Basic Idea and Related work
In this section, the basic idea and architecture for a typical Network Intrusion
Detection System is discussed followed by the previous implementations.
5.2.1 NIDS and Multiple pattern matching
As discussed before, a NIDS is simply a software application or a specialized
hardware which monitors the network packets for malicious activities. It maintains
a database of fixed or variable sized patterns which are searched against an input
data packet. A basic architecture for a NIDS is given in Figure 5.1. At the top
level, it works as an alarm in the network but at the core , it is computationally
challenging as it requires deep packet inspection and that too in network speed.
For a high speed network, deep packet inspection signifies that every byte of every
packet must be searched for multiple patterns. So in a nutshell, the operation is
nothing but a multiple pattern matching algorithm.
Figure 5.1: Basic Architecture for Signature based NIDS
Scanning or monitoring a packet in a network involves both header as well as
payload analysis of the packet. The overhead for the header analysis is much less
41