A multi-Gb/s parallel string matching engine for intrusion detection systems

Abstract

This paper describes a Finite State Machine (FSM) approach on string matching for Intrusion Detection Systems (IDS). Search patterns are sliced into multiple interleaved substrings and feed into parallel FSMs. The final match results from combining the outputs of parallel individual FSMs. The proposed engine is primarily designed for ASCII codes and extended to support (16-bit) Unicode. The designed engine with 4-byte input words can reach search rates of over 30 Gb/s. © 2008 Springer-Verlag.