A CONTENT-ADDRESSABLE-MEMORY ASSISTED INTRUSION PREVENTION EXPERT SYSTEM FOR GIGABIT NETWORKS

摘要: Cyber intrusions have become a serious problem with growing frequency and complexity. Current Intrusion Detection/Prevention Systems (IDS/IPS) are deficient in speed and/or accuracy. Expert systems one functionally effective IDS/IPS method. However, they general computationally intensive too slow for real time requirements. This poor performance prohibits expert system's applications gigabit networks. dissertation describes novel intrusion prevention system architecture that utilizes the parallel search capability of Content Addressable Memory (CAM) to perform detection at gigabit/second wire speed. A CAM is memory compares all its entries against input data parallel. much faster than serial operation Random Access (RAM). The major contribution this thesis accelerate bottleneck "match" processes using power CAM, thereby enabling network applications. To map an Match process into research introduces "Contextual Rule" (C-Rule) method fundamentally changes systems' computational structures without changing functionality domain. combines rules current states new type dynamic rule exists only under specific state conditions. converts conventional two-database match one-database process. Therefore it enables core be mapped take advantage parallelism.This also CAM-Assisted Prevention System (CAIPES) shows how can support vast majority 1999 Lincoln Lab's DARPA Detection Evaluation set, open source IDS "Snort". Supported able detect single-packet attacks, abusive traffic packet flooding sequences packets attacks. Prototyping simulation been performed demonstrate these four types Hardware existing CAIPES gigabit/s IDS/IPS.