Energy efficient and high throughput prefix-based pattern matching technique on TCAMs for NIDS

Abstract

Intrusion Detection System (IDS) is a type of packet filtering that ensures network security by analyzing the packets flowing through the network and detecting any malicious pattern(s) present in them. In signature-based NIDS, pattern matching is the critical step as it determines the system’s performance. The throughput of the system, inherently, relies on the delay required to match an input pattern. Hardware-based high-speed pattern matching algorithms are popularly used to speed up the pattern matching process and improve the system’s performance. Ternary Content Addressable Memory (TCAM) is one such memory in which the input pattern is simultaneously launched on all the match lines. Since all the match lines and search lines are activated at a given instance, the power consumed per search is extremely high. To address this issue, this paper proposes an approach in which the match is carried out with an n-bit prefix of the input pattern that enables a smaller TCAM unit, which contains the patterns having this prefix. A significant improvement in energy is observed since a single TCAM segment is enabled for a single search. The results are compared with existing solutions, and energy improvement of 96.1% is observed with worst case and best case throughput of $17Gbps$ and $148Gbps$, respectively.