An FPGA-based network intrusion detection architecture

Abhishek Das*, David Nguyen, Joseph Zambreno, Gokhan Memik, Alok Nidhi Choudhary

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

67 Scopus citations

Abstract

Network intrusion detection systems (NIDSs) monitor network traffic for suspicious activity and alert the system or network administrator. With the onset of gigabit networks, current generation networking components for NIDS will soon be insufficient for numerous reasons; most notably because the existing methods cannot support high-performance demands. Field-programmable gate arrays (FPGAs) are an attractive medium to handle both high throughput and adaptability to the dynamic nature of intrusion detection. In this work, we design an FPGA-based architecture for anomaly detection in network transmissions. We first develop a feature extraction module (FEM) which aims to summarize network information to be used at a later stage. Our FPGA implementation shows that we can achieve significant performance improvements compared to existing software and application-specific integrated-circuit implementations. Then, we go one step further and demonstrate the use of principal component analysis as an outlier detection method for NIDSs. The results show that our architecture correctly classifies attacks with detection rates exceeding 99% and false alarms rates as low as 1.95%. Moreover, using extensive pipelining and hardware parallelism, it can be shown that for realistic workloads, our architectures for FEM and outlier analysis achieve 21.25- and 23.76-Gb/s core throughput, respectively.

Original languageEnglish (US)
Pages (from-to)118-132
Number of pages15
JournalIEEE Transactions on Information Forensics and Security
Volume3
Issue number1
DOIs
StatePublished - Mar 2008

Keywords

  • Feature extraction
  • Field-programmable gate arrays (FPGA)
  • Network intrusion detection system (NIDS)
  • Principal component analysis (PCA)

ASJC Scopus subject areas

  • Safety, Risk, Reliability and Quality
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'An FPGA-based network intrusion detection architecture'. Together they form a unique fingerprint.

Cite this