利用決策樹改善以; FPGA 為基礎之入侵偵測系統資源利用 Using Decision Trees to Improve Resource Utilization on FPGA-based Network Intrusion Detection System

NCUIR > School of Management at National Central University > Graduate Institute of Information Management > Electronic Thesis & Dissertation > Item 987654321/13501

Please use this identifier to cite or link to this item: http://ir.lib.ncu.edu.tw/handle/987654321/13501

Title:	利用決策樹改善以;FPGA 為基礎之入侵偵測系統資源利用 Using Decision Trees to Improve Resource Utilization on FPGA-based Network Intrusion Detection System
Authors:	魏雅笛;Ya-Ti Wei
Contributors:	資訊管理研究所
Keywords:	入侵偵測系統;非決定性有限狀態自動機;決策樹;現場可規劃邏輯閘陣列;Network intrusion detection systems (NIDS);Decision tree;NFA;FPGA
Date:	2008-06-23
Issue Date:	2009-09-22 15:33:29 (UTC+8)
Publisher:	國立中央大學圖書館
Abstract:	網路的應用對於目前個人及企業越來越重要，網路的頻寬也不斷的成長，網路入侵測系統基於特徵比對便成為個人及企業不可或缺的基礎防謢。然而目前入侵偵測系統大多架設在軟體的架構之上，越來越無法應付目前網路現況；相反地，硬體具有高速及帄行比對能力，能夠進行快速的比對，尤其 FPGA 能重覆燒錄及快速製作雛型，相當合適設計入侵偵測系統。但 FPGA 內所能使用的資源有限，而特徵資料庫卻需要不斷的更新及擴張，故本研究基於以上動機，利用 FPGA 設計入侵偵測系統，以決策樹處理規則的標頭，再依規則標頭比對架構建置多字串比對群組來進行封包內容的比對。本研究提出的架構帄均可以降低 56%的電路資源使用率，故能擁有更多資源來擴充新的規則，具有可擴張性，而且採用多字串比對群組，可以使用特徵字串帄行比對增加效能，實驗証明本系統架構可以使用較少的資源，且較其它 FPGA 設計更具效能。 As network services become more and more important in our society, the demand for network security systems is increasing. Network intrusion detection systems (NIDS) provide an effective and secure solution to the network attacks and are widely used in enterprises. Many NIDSs, such as Snort, are based on software, so their processing speeds are much slower than wire-speed. FPGA technology has properties which are high speed string matching and reprogrammable, but the resources in FPGA are limited while the database of signatures has become very large and keeps growing. In this thesis we use decision tree to improve the utilization of resources when implementing NIDS on FPGA. The system uses decision tree to process the rule header to reduce resource requirements. Rule options are organized to multiple string matching groups according to the matching results of rule header. We implement an IDS circuit that process 1023 Snort rules at FPGA. The experimental results show that the system can reduce the average of resource by 56%. In addition, we develop a tool to automatically generate the Verilog HDL source code of the IDS circuit from a Snort rule set. Using the FPGA and the IDS circuit generator, the proposed system is able to update the matching rule corresponding to new intrusion and attacks.
Appears in Collections:	[Graduate Institute of Information Management] Electronic Thesis & Dissertation

Files in This Item:

File	Size	Format

社群 sharing

Loading...