網路的應用對於目前個人及企業越來越重要，網路的頻寬也不斷的成長，網 路入侵測系統基於特徵比對便成為個人及企業不可或缺的基礎防謢。然而目前入 侵偵測系統大多架設在軟體的架構之上，越來越無法應付目前網路現況；相反地， 硬體具有高速及帄行比對能力，能夠進行快速的比對，尤其 FPGA 能重覆燒錄及 快速製作雛型，相當合適設計入侵偵測系統。但 FPGA 內所能使用的資源有限， 而特徵資料庫卻需要不斷的更新及擴張，故本研究基於以上動機，利用 FPGA 設 計入侵偵測系統，以決策樹處理規則的標頭，再依規則標頭比對架構建置多字串 比對群組來進行封包內容的比對。本研究提出的架構帄均可以降低 56%的電路資 源使用率，故能擁有更多資源來擴充新的規則，具有可擴張性，而且採用多字串 比對群組，可以使用特徵字串帄行比對增加效能，實驗証明本系統架構可以使用 較少的資源，且較其它 FPGA 設計更具效能。 As network services become more and more important in our society, the demand for network security systems is increasing. Network intrusion detection systems (NIDS) provide an effective and secure solution to the network attacks and are widely used in enterprises. Many NIDSs, such as Snort, are based on software, so their processing speeds are much slower than wire-speed. FPGA technology has properties which are high speed string matching and reprogrammable, but the resources in FPGA are limited while the database of signatures has become very large and keeps growing. In this thesis we use decision tree to improve the utilization of resources when implementing NIDS on FPGA. The system uses decision tree to process the rule header to reduce resource requirements. Rule options are organized to multiple string matching groups according to the matching results of rule header. We implement an IDS circuit that process 1023 Snort rules at FPGA. The experimental results show that the system can reduce the average of resource by 56%. In addition, we develop a tool to automatically generate the Verilog HDL source code of the IDS circuit from a Snort rule set. Using the FPGA and the IDS circuit generator, the proposed system is able to update the matching rule corresponding to new intrusion and attacks.
