Abstract
Pattern matching using Aho-Corasick (AC) algorithm is the most time-consuming task in an Intrusion Detection System, and therefore, the Field Programmable Gate Array (FPGA) based solutions are frequently employed. In this context, the two possibilities are memory based solutions and hardwired solution. The limitation of memory based solutions is the inefficient utilization of slices while the hardwired solutions require a tremendous amount of effort and time as writing Hardware Description Language (HDL) code for thousands of rules is prone to human errors. Consequently, the contributions of this article are twofold. The first contribution is to develop a tool for the automatic generation of Verilog-HDL code from the rule set. The second contribution is to propose an efficient parallel hardware implementation scheme and compare it with a serial hardware implementation scheme in terms of various design parameters such as resource utilization, operational frequency and throughput. The proposed parallel scheme advocates the division of entire rule set into smaller sub-sets for parallel execution. Experimental results reveal that the proposed tool can generate the target code for 10,000 rules in less than a minute without any error. The automatic generation of target code has allowed to perform a comprehensive design space exploration for the parallel implementation of AC algorithm in quick time. Finally, our Xilinx ZC702 evaluation FPGA board based prototype for 10,000 rules can efficiently examine the packet stream coming at a bit rate of 1.56 Gbps at an operational frequency of 195 MHz.