FPGA based High speed and low area cost pattern matching

Intrusion detection and prevention system have to define more and more patterns to identify the diversification intrusions. Pattern matching, the main part of almost every modern intrusion detection system, should provide exceptionally high performance and ability of reconfiguration. FPGA based pattern matching sub-system becomes a popular solution for modern intrusion detection system. But there is still significant space to improve the FPGA resource efficiency. In this paper, we present a novel pattern matching implementation using the half byte comparators (HBC). HBC based pattern matching approach can increase the area efficiency. But the operating frequency will be a little decrease. We also explored some methods to improve the operating frequency in this paper. The result shows for matching more than 22,000 characters (all the rules in SNORT v2.0) our implementation achieving an area efficiency of more than 3.13 matched characters per logic cell, achieving an operating frequency of about 325 MHz (2.6 Gbps) on a Virtex-II pro device. When using quad parallelism to increase the matching throughput, the area efficiency of a logic cell is decrease to 0.71 characters for a throughput of almost 8.5 Gbps.