A Scalable Pattern Matching Implementation on Hardware using Data Level Parallelism

Pattern matching in Intrusion Detection Systems (IDS) is one of the most critical and time-consuming elements, allowing the system to make decisions based on the real-time threats across the network. A pattern-matching method can be software-based or hardware-based. In this paper, a hardware implementation of bit-split algorithm has been discussed for pattern matching in order to detect unwanted traffic for a maximum number of rulesets. A hardware-based string matching scheme has been preferred here due to its fast speed and quick data parallelism for the high-performance Intrusion Detection System (IDS). The prototype of the detection method is implemented on Spartan SP605 with a small number of rules. For a large number of rules, a multi-scale Field Programmable Gate Array (FPGA)-based hardware architecture has been implemented in which we have used NetFPGA-SUME. This FPGA board has examined incoming packets at a bit rate of 1.25 Gb/sec with an operational frequency of 156.25MHZ. Furthermore, high-level data parallelism has been implemented by instantiating more than one match engine for handling multiple packets to achieve high throughput (T
p
).