Real-time feature extraction for high speed networks

David Nguyen*, Gokhan Memik, Seda Ogrenci Memik, Alok Choudhary

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contribution

13 Scopus citations

Abstract

With the onset of Gigabit networks, current generation networking components will soon be insufficient for numerous reasons: most notably because existing methods cannot support high performance demands. Feature extraction (or flow monitoring), an essential component in anomaly detection, summarizes network behavior from a packet stream. This information is fed into intrusion detection methods such as association rule mining, outlier analysis, and classification algorithms in order to characterize network behavior. However, current feature extraction methods based on per-flow analysis are expensive, not scalable, and thus prohibitive for large-scale networks. In this paper, we propose an accurate and scalable Feature Extraction Module (FEM) based on sketches. We present the details of the FEM design on an FPGA and show that using FPGAs we can achieve significantly better performance compared to existing software and ASIC implementations. Specifically, the optimal FEM configuration achieves 21.25 Gbps throughput and 97.61% accuracy.

Original languageEnglish (US)
Title of host publicationProceedings - 2005 International Conference on Field Programmable Logic and Applications, FPL
Pages438-443
Number of pages6
DOIs
StatePublished - 2005
Event2005 International Conference on Field Programmable Logic and Applications, FPL - Tampere, Finland
Duration: Aug 24 2005Aug 26 2005

Publication series

NameProceedings - 2005 International Conference on Field Programmable Logic and Applications, FPL
Volume2005

Other

Other2005 International Conference on Field Programmable Logic and Applications, FPL
CountryFinland
CityTampere
Period8/24/058/26/05

ASJC Scopus subject areas

  • Engineering(all)

Fingerprint Dive into the research topics of 'Real-time feature extraction for high speed networks'. Together they form a unique fingerprint.

Cite this