CMA: A Reconfigurable Complex Matching Accelerator for Wire-Speed Network Intrusion Detection

Memory which is used for searching applications, like Network routers, operating at a higher speed is called Ternary Content Addressable Memory (TCAM). The requirement of TCAM is gradually growing in the searching field applications. TCAM memories are usually built in ASIC (Application Specific Integrated Circuit) which offers searching operation at a higher speed in a predetermined time but is expensive in cost. TCAMs designed on FPGAs (Field Programmable Gate Array) experience high power consumption, larger use of FPGA resources, and suffer from the inefficiency of storage. TCAM using multipumping and multiported SRAM is designed for achieving an effectual use of FPGA resources, and a reduction in usage of power and area. In the present SRAM based TCAM designs, there is an exponential growth in memory usage due to the increase in the patterns of TCAM, which is reduced by cascading the multiple blocks of SRAM (BRAMs) in FPGA that makes growth linear. BRAMs of FPGAs have restrictions in depth, which restricts the effectual storage of TCAM bits. In this paper, a modified TCAM design is proposed which avoids this restriction by using shallow sub-blocking of BRAMs. The design proposed in this paper operates the multiported SRAM by using the dual-port BRAM and by clocking it internally at a higher frequency using multipumping technique which allows access of the BRAM subblocks in one cycle of the system clock. These modifications in the divisional traditional TCAM table results in an effectual design of TCAM memory. The proposed design is coded in Verilog and simulated using the Xilinx ISE tool and was implemented on a Virtex 7xc7vx485 FPGA device. The proposed design has better performance, in terms of 26% reduction in power and 7% reduction in area, as compared to existing SRAM based TCAM design.

As a special type of memory, Ternary Content Addressable Memory (TCAM) has been widely employed in network routers and various applications that require high speed table lookup. However, the large cell area and high static power consumption of traditional CMOS-based TCAMs have always constrained its advance toward higher capacity. Therefore, many non-volatile memory devices, such as ReRAM, FeFET, and MRAM, are emerging in TCAM designs to address these issues. However, SOT-MRAM devices with ultra-high write speed, low power consumption and small cell area are not effectively utilized in TCAM designs due to their low tunnel magnetoresistance (TMR) ratio, etc. In this work, first, combining the ultra-high performance of SOT-MRAM and the reliability of STT-MRAM, a 4T-3MTJ SOT/STT hybrid NV-TCAM structure with ultra-high integration density is proposed. However, to eliminate the lower match line utilization caused by the low TMR of SOT-MRAM, another highly reliable 7T-3MTJ NV-TCAM structure is proposed. Simulation results show that the proposed two TCAM structures can achieve search speed of 0.4ns and 0.15ns with only 4 and 7 transistors, respectively. While maintaining high performance, their write energy is only 0.133pJ/bit, a maximum reduction of 91.6% over existing TCAM designs. Meanwhile, the array-level simulations prove the great potential of the proposed design in terms of integration density and performance.

This paper describes the ESIDE-Depian intrusion detection and prevention system, which uses Bayesian structural and parametric learning and also evidence propagation and adaptation, in order to improve the accuracy and manageability of network intrusion detection systems (NIDS). Current NIDS do not consider the two main detection paradigms, i.e. misuse detection and anomaly detection, in an unified style, so the analysis is not inherently complete. Besides, historical data are not generally used, neither for analysis nor for sequential adaptation of the knowledge representation models used for detection; hence this wealthy information about the essence and the potential trends of the target system is not commonly considered. Thus, by the generalized use of Bayesian belief networks, ESIDE-Depian achieves the main goal of detecting and preventing both well-known and also zero-day attacks with excellent results, by means of unified real-time analysis of network traffic.

Network Intrusion Detection Systems (NIDS) require the sensors to inspect the packet payloads at line rates. However, the software-only NIDS can not handle the large signature set with thousands of patterns of different lengths at line rates. Ternary content-addressable memories (TCAMs) have gained wide acceptance in the industry for storing and searching patterns in routers. But one important problem blocked the way to deploy TCAMs as deep package matching engines for NIDS: long patterns matching. A novel high speed long patterns matching architecture using cascade TCAMs for large signature set based NIDS is presented in this paper. Simple and efficient systems to handle tens of thousands of signatures with thousands of bytes length each can be built on such architecture. The matching system using for current SNORT signature set can work at the speeds greater than 2 Gbps.

Network intrusion detection system is a significant guarantee means for network security. However, the current network intrusion detection system generally suffers from less prior knowledge which then leads to poor generalizing ability. Network intrusion detection system based on support vector machine is endowed with favorable generalizing ability even with small sample size (less prior knowledge). The paper first gives an introduction to the basic concept of intrusion detection and the basic principle of the classifier based on support vector machine, then discusses algorithm of support vector machine, and finally forms network intrusion detection system combining anomaly intrusion detection and misuse intrusion detection, based on support vector machine.

Modern network routers provide differentiated services for incoming network packets based on classification, where the packet header is compared against a rule set for matching. Traditional packet classification only reports a single matched rule with the highest priority in case of multiple matched ones. With the emergence of new applications such as network intrusion detection system (NDIS), all matched rules need to be reported. This multi-match problem is more challenging and is getting higher attention in recent years. Because of the stringent time budget on classification, architectural solutions using Ternary Content Addressable Memory (TCAM) attract more attention than software solutions for backbone network routers. However, despite its advantage on search speed, TCAM is much more expensive than SRAM, and is notorious for its extraordinarily high power consumption. These problems limit the application and scalability of TCAM solutions. This paper presents a novel tree-based hybrid TCAM+SRAM solution for the purposes of both TCAM space reduction and power saving. The experiments show that the proposed solution achieves significantly more savings on both memory space and power consumption on packet matching than existing solutions.

Feature extraction for machine learning-based intrusion detection in IoT networks

As manufacture process scales down rapidly, the design of ternary content-addressable memory (TCAM) requiring high storage density, fast access speed and low power consumption becomes very challenging. In recent years, many novel TCAM designs have been inspired by the research on emerging nonvolatile memory technologies, such as magnetic tunneling junction (MTJ), phase change memory (PCM), and memristor. These designs store a data as the resistive variable of a nonvolatile device, which usually results in limited sensing margin and therefore constrains the searching speed of TCAM architecture severely. To further enhance the performance and robustness of TCAMs, we proposed two novel cell designs that utilize MTJs as data storage units - the symmetrical dual-N structure and the asymmetrical P-N scheme. In both designs, a body bias feedback circuit is integrated to enlarge the sensing margins. Compared with an existing MTJ-based TCAM structure, the tolerance in gate voltage variation of the symmetrical dua-N (asymmetrical P-N) scheme can significantly improve 59.5% (21.2%). The latency and the dynamic energy consumption in one searching operation at the word length of 256 bits are merely 590.35ps (97.89ps) and 65.05fJ/bit (36.85fJ/bit), not even mentioning that the use of nonvolatile MTJ devices avoids unnecessary leakage power consumption.

Among the beyond-complementary metal-oxide- semiconductor (CMOS) devices being explored, ferroelectric field-effect transistors (FeFETs) are considered as one of the most promising. FeFETs are being studied by all major semiconductor manufacturers, and experimentally, FeFETs are making rapid progress. FeFETs also stand out with the unique hysteretic Ids-Vgs characteristic that allows a device to function as both a switch and a nonvolatile (NV) storage element. We exploit this FeFET property to build two categories of fine-grained logic-in-memory (LiM) circuits: 1) ternary content addressable memory (TCAM) which integrates efficient and compact logic/processing elements into various levels of memory hierarchy; 2) basic logic function units for constructing larger and more complex LiM circuits. Two writing schemes (with and without negative supply voltages respectively) for FeFETs are introduced in our LiM designs. The resulting designs are compared with existing LiM approaches based on CMOS, magnetic tunnel junctions (MTJs), resistive random access memories (ReRAMs), ferrorelectric tunnel junctions (FTJs), etc., that afford the same circuit-level functionality. Simulation results show that FeFET-based NV TCAMs offer lower area overhead than MTJ (79%) and CMOS (42% less) equivalents, as well as better search energy-delay products (EDPs) than TCAM designs based on MTJ (149×), ReRAM (1.7×), and CMOS (1.3×) in array evaluations. NV FeFET-based LiM basic circuit blocks are also more efficient than functional equivalents based on MTJs in terms of propagation delay (4.2×) and dynamic power (2.5×). A case study for an FeFET-based LiM accumulator further demonstrates that by employing FeFET as both a switch and an NV storage element, the FeFET-based accumulator can save area (36%) and power consumption (40%) when compared with a conventional CMOS accumulator with the same structure.

Network intrusion detection systems (NIDS) plays an increasing important role in the field of network security. Current NIDS, such as Bro and Snort, mainly use signatures to represent and detect networking attacks. Traditionally the signatures are depicted by exact string patterns. However, new worms and viruses emerge endlessly in recent years. As a result, the scale of signatures increases sharply. Compared with exact strings, regular expressions have more powerful expressiveness, and are replacing exact strings gradually in state-of-the-art NIDS.

Ternary Content Addressable Memory (TCAM) is widely used in network infrastructure for various search functions. There has been a growing interest in implementing TCAM using reconfigurable hardware such as Field Programmable Gate Array (FPGA). Most of existing FPGA-based TCAM designs are based on brute-force implementations, which result in inefficient on-chip resource usage. As a result, existing designs support only a small TCAM size even with large FPGA devices. They also suffer from significant throughput degradation in implementing a large TCAM, mainly caused by deep priority encoding. This paper presents a scalable random access memory (RAM)-based TCAM architecture aiming for efficient implementation on state-of-the-art FPGAs. We give a formal study on RAM-based TCAM to unveil the ideas and the algorithms behind it. To conquer the timing challenge, we propose a modular architecture consisting of arrays of small-size RAM-based TCAM units. After decoupling the update logic from each unit, the modular architecture allows us to share each update engine among multiple units. This leads to resource saving. The capability of explicit range matching is also offered to avoid range-to-ternary conversion for search functions that require range matching. Implementation on a Xilinx Virtex 7 FPGA shows that our design can support a large TCAM of up to 2.4 Mbits while sustaining high throughput of 150 million packets per second. The resource usage scales linearly with the TCAM size. The architecture is configurable, allowing various performance trade-offs to be exploited. To the best of our knowledge, this is the first FPGA design that implements a TCAM larger than 1 Mbits.

An embedded intrusion detection system based on ARM9 is proposed to overcome problem existing in the current network intrusion detection systems. The system is designed as ARM9 microprocessor core, using the Linux-2.4 kernel as the underlying operating system; with misuse detection and protocol analysis techniques to complete the data packets of real-time detection and extraction using unsupervised clustering algorithm for intrusion characteristics, expansion of the existing rule base invasion. Experimental results show that the design of the system has good detection capability and high stability under certain conditions.

Ternary Content Addressable Memories (TCAMs) have become the de facto standard in industry for fast packet classification. Unfortunately, TCAMs have limitations of small capacity, high power consumption, high heat generation, and high cost. The well-known range expansion problem exacerbates these limitations as each classifier rule typically has to be converted to multiple TCAM rules. One method for coping with these limitations is to use compression schemes to reduce the number of TCAM rules required to represent a classifier. Unfortunately, all existing compression schemes only produce prefix classifiers. Thus, they all miss the compression opportunities created by non-prefix ternary classifiers.

Ternary Content Addressable Memory (TCAM) is widely used by modern routers and switches to support policy-based forwarding due to its incomparable lookup speed and flexible matching patterns. However, the limited TCAM capacity does not scale with the ever-increasing rule table size due to the high hardware cost and high power consumption. At present, using TCAM just as a rule cache is an appealing solution, but one must resolve several tricky issues including the rule dependency and the associated TCAM updates. In this paper, we propose a new approach which can generate dependency-free rules to cache. By removing the rule dependency, the complex TCAM update problem also disappears. We provide the complete T-cache system design including slow path processing and cache replacement, and implement a T-cache prototype on Barefoot Tofino switches. We conduct comprehensive software simulations and hardware experiments based on real-world and synthesized rule tables and packet traces to show that T-cache is efficient and robust for network traffic in various scenarios.

Network packet classification is a key functionality provided by modern routers enabling many new network applications such as quality of service, access control and differentiated services. Using ternary content addressable memories (TCAMs) to perform high-speed packet classification has become the de facto standard in industry. However, despite their high speed, one major drawback of TCAMs is their high power consumption. Although SmartPC, the state-of-the-art technique, was proposed to reduce power consumption by constructing a pre-classifier to activate TCAM blocks selectively, its bottom-up approach restricts its ability of grouping rules into disjoint TCAM blocks. In this paper, we propose a top-down approach for two-stage TCAM-based packet classification. The novelty of our work is the intelligent combination of software-based packet classification with TCAM-based techniques. We start by constructing a set of decision-trees for the packet classification rules, which enable the subsequent steps an excellent global view on the relationships among rules. The decision-trees are then mapped to TCAM blocks with flexible heuristics. Our top-down framework addresses the bottlenecks (the number of general rules, which have to be activated unconditionally every time) of SmartPC very effectively. Using ClassBench in our experimentations, we show that our technique is able to restrict the number of general rules to just 1% of the overall rule set. This leads to a dramatic power reduction of up to 98%, and 96% on average, which significantly outperforms SmartPC.