| DC 欄位 |
值 |
語言 |
| DC.contributor | 資訊管理學系 | zh_TW |
| DC.creator | 魏雅笛 | zh_TW |
| DC.creator | Ya-Ti Wei | en_US |
| dc.date.accessioned | 2009-7-17T07:39:07Z | |
| dc.date.available | 2009-7-17T07:39:07Z | |
| dc.date.issued | 2009 | |
| dc.identifier.uri | http://ir.lib.ncu.edu.tw:88/thesis/view_etd.asp?URN=964203002 | |
| dc.contributor.department | 資訊管理學系 | zh_TW |
| DC.description | 國立中央大學 | zh_TW |
| DC.description | National Central University | en_US |
| dc.description.abstract | 網路的應用對於目前個人及企業越來越重要，網路的頻寬也不斷的成長，網
路入侵測系統基於特徵比對便成為個人及企業不可或缺的基礎防謢。然而目前入
侵偵測系統大多架設在軟體的架構之上，越來越無法應付目前網路現況；相反地，
硬體具有高速及帄行比對能力，能夠進行快速的比對，尤其 FPGA 能重覆燒錄及
快速製作雛型，相當合適設計入侵偵測系統。但 FPGA 內所能使用的資源有限，
而特徵資料庫卻需要不斷的更新及擴張，故本研究基於以上動機，利用 FPGA 設
計入侵偵測系統，以決策樹處理規則的標頭，再依規則標頭比對架構建置多字串
比對群組來進行封包內容的比對。本研究提出的架構帄均可以降低 56%的電路資
源使用率，故能擁有更多資源來擴充新的規則，具有可擴張性，而且採用多字串
比對群組，可以使用特徵字串帄行比對增加效能，實驗証明本系統架構可以使用
較少的資源，且較其它 FPGA 設計更具效能。
| zh_TW |
| dc.description.abstract | As network services become more and more important in our society, the demand
for network security systems is increasing. Network intrusion detection systems (NIDS)
provide an effective and secure solution to the network attacks and are widely used in
enterprises. Many NIDSs, such as Snort, are based on software, so their processing
speeds are much slower than wire-speed. FPGA technology has properties which are
high speed string matching and reprogrammable, but the resources in FPGA are limited
while the database of signatures has become very large and keeps growing.
In this thesis we use decision tree to improve the utilization of resources when
implementing NIDS on FPGA. The system uses decision tree to process the rule
header to reduce resource requirements. Rule options are organized to multiple string
matching groups according to the matching results of rule header. We implement an
IDS circuit that process 1023 Snort rules at FPGA. The experimental results show
that the system can reduce the average of resource by 56%.
In addition, we develop a tool to automatically generate the Verilog HDL source
code of the IDS circuit from a Snort rule set. Using the FPGA and the IDS circuit
generator, the proposed system is able to update the matching rule corresponding to
new intrusion and attacks.
| en_US |
| DC.subject | 入侵偵測系統 | zh_TW |
| DC.subject | 非決定性有限狀態自動機 | zh_TW |
| DC.subject | 決策樹 | zh_TW |
| DC.subject | 現場可規劃邏輯閘陣列 | zh_TW |
| DC.subject | Network intrusion detection systems (NIDS) | en_US |
| DC.subject | Decision tree | en_US |
| DC.subject | NFA | en_US |
| DC.subject | FPGA | en_US |
| DC.title | 利用決策樹改善以 FPGA 為基礎之入侵偵測系統資源利用 | zh_TW |
| dc.language.iso | zh-TW | zh-TW |
| DC.title | Using Decision Trees to Improve Resource Utilization on FPGA-based Network Intrusion Detection System | en_US |
| DC.type | 博碩士論文 | zh_TW |
| DC.type | thesis | en_US |
| DC.publisher | National Central University | en_US |