FPGA based network intrusion detection using content addressable memories

In this paper, we introduce a novel architecture for a hardware based network intrusion detection system (NIDS). Current software-based NIDS are too compute intensive and cannot meet the bandwidth requirements of a modern network. Thus, hardware techniques are desired to speed up network processing. This paper introduces a FPGA based keyword match processor that can serve as the core of a hardware based NIDS. The keyword match processor's key feature is a cellular processor architecture that allows content addressable memory (CAM) to process variable sized keys. These CAMs allow us to perform intrusion detection signature lookup at line speed at rates well past 2 Gbps.