1 An Evolution of Pattern Matching within Network Intrusion Detection Systems Erik Anderson 9 November 2006

2 Overview Introduction and Background Software Approaches Soft Core Processors Circuit Based Pattern Matching Automatic Synthesis Memory Based Pattern Matching Comparisons of Techniques Future Works

3 Introduction and Background Network Intrusion Detection/Prevention Systems Pattern Matching in Application Layer Patterns/Network speed growing faster than CPU speeds Reconfigurable Computing Price, performance, power middle ground between CPUs and ASICs.

4 Software Approaches Commercial NDIS Snort Hogwash Algorithms Brute Force Knuth-Morris-Pratt Aho-Corasick

5 From: Dharmapurikar 2005

6 Soft Core Processors Customize processors for an application. Objective: find a “good” solution in linear time. On board evaluation with SPARC V8. 79 parameters … 3.6 trillion configurations Lockwood, Washington University

7 Soft Core Processors Evaluation Technique Assume parameter independence. Start with “out of box” configuration. Rebuild and evaluate processor, tweaking one parameter at a time. Results (BLASTN) 11.59% Runtime improvement 0% change in slices 39% increase in BRAMs Lockwood, Washington University

8 Circuit Based Pattern Matching Uses Brute Force Method in Hardware Very fast Highly parallel Ideal for reconfigurable computing Expensive Schimmel, Georgia Tech Mangione-Smith, UCLA From: Cho 2003

9 Shared Substring Reduced circuit size Circuit Based Pattern Matching Schimmel, Georgia Tech Mangione-Smith, UCLA From: Cho 2003

10 Character Decoding Statefull comparison Reduced circuit size Circuit Based Pattern Matching Schimmel, Georgia Tech Mangione-Smith, UCLA From: Clark 2004

11 Automatic Synthesis Given a high-level description, automatically generate a circuit. ROCCC Translates C -> SUIF -> VHDL Extensive loop analysis to find task level parallelism. Generalized tool. Prasanna, USC Jajjar, UC Riverside

12 Automatic Synthesis Riverside Input is a set of search strings. Generates circuit based on: Knuth-Morris-Pratt Character Decoding method Prasanna, USC Jajjar, UC Riverside

13 Memory Based Pattern Matching Circuit based approaches are fast but not scalable. Throughput depends on unrealistic bus model. Resynthesize with new search strings. Paradigm switch to using memory to hold strings, and circuits to manage control path. Mangione-Smith, UCLA Lockwood, Washington University

14 Hybrid Model Divide search string into prefix and suffix. 1.Use circuit based design to match prefixes. 2.Use memory lookup to match suffix. Mangione-Smith, UCLA Lockwood, Washington University From: Cho 2003

15 Jump-ahead Aho-Corasick Circuit implements Variation of Aho- Corasick state machine. Treat k-characters as single symbol. Mangione-Smith, UCLA Lockwood, Washington University From: Dharmapurikar 2005

16 Jump-ahead Aho-Corasick Search strings held in memory data structures. 1 clock cycle Bloom filter to lookup state transition. Multiple cores to improve performance. Mangione-Smith, UCLA Lockwood, Washington University From: Dharmapurikar 2005

17 Comparisons of Techniques TechniqueSpeed (Gbps) Size (slices) Character Decoding K - 60K Automatic Char. Decode K - 32K ROCCC18.638K Hybrid3.26.1K / 11KB JACK-NFA NA / 6-47 KB

18 Future Works Runtime reconfiguration of circuit based systems. Dealing with fragmented packets. Applications towards bioinformatics.

19 Abstractions for NIDS Motivation: Collapse of Moore’s Law, increased threats, & design complexity. Paradigm shift from fast individual packet processing, to fast cumulative processing. Long term goals: HLL to describe network analysis. Abstracting parallel techniques. Automatic compilation/synthesis of circuits. Lockwood, Washington University

20 Questions?