{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T04:52:41Z","timestamp":1750308761796,"version":"3.41.0"},"reference-count":42,"publisher":"Association for Computing Machinery (ACM)","issue":"2","license":[{"start":{"date-parts":[[2008,1,29]],"date-time":"2008-01-29T00:00:00Z","timestamp":1201564800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Embed. Comput. Syst."],"published-print":{"date-parts":[[2008,2]]},"abstract":"<jats:p>Most network routers and switches provide some protection against the network attacks. However, the rapidly increasing amount of damages reported over the past few years indicates the urgent need for tougher security. Deep-packet inspection is one of the solutions to capture packets that can not be identified using the traditional methods. It uses a list of signatures to scan the entire content of the packet, providing the means to filter harmful packets out of the network. Since one signature does not depend on the other, the filtering process has a high degree of parallelism. Most software and hardware deep-packet filters that are in use today execute the tasks under Von Neuman architecture. Such architecture can not fully take advantage of the parallelism. For instance, one of the most widely used network intrusion-detection systems, Snort, configured with 845 patterns, running on a dual 1-GHz Pentium III system, can sustain a throughput of only 50 Mbps. The poor performance is because of the fact that the processor is programmed to execute several tasks sequentially instead of simultaneously. We designed scalable deep-packet filters on field-programmable gate arrays (FPGAs) to search for all data-independent patterns simultaneously. With FPGAs, we have the ability to reprogram the filter when there are any changes to the signature set. The smallest full-pattern matcher implementation for the latest Snort NIDS fits in a single 400k Xilinx FPGA (Spartan 3-XC3S400) with a sustained throughput of 1.6 Gbps. Given a larger FPGA, the design can scale linearly to support a greater number of patterns, as well as higher data throughput.<\/jats:p>","DOI":"10.1145\/1331331.1331345","type":"journal-article","created":{"date-parts":[[2008,2,28]],"date-time":"2008-02-28T14:02:33Z","timestamp":1204207353000},"page":"1-26","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":28,"title":["Deep network packet filter design for reconfigurable devices"],"prefix":"10.1145","volume":"7","author":[{"given":"Young H.","family":"Cho","sequence":"first","affiliation":[{"name":"University of California, Los Angeles, California"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"William H.","family":"Mangione-Smith","sequence":"additional","affiliation":[{"name":"University of California, Los Angeles, California"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2008,1,29]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/360825.360855"},{"key":"e_1_2_1_2_1","doi-asserted-by":"crossref","unstructured":"Allen J. Christie A. Fithen W. McHugh J. Pickel J. and Stoner E. 2000. State of the practice of intrusion detection technologies. Tech. rep. Carnegie Mellon Software Engineering Institute. (Jan.)  Allen J. Christie A. Fithen W. McHugh J. Pickel J. and Stoner E. 2000. State of the practice of intrusion detection technologies. Tech. rep. Carnegie Mellon Software Engineering Institute. (Jan.)","DOI":"10.21236\/ADA375846"},{"key":"e_1_2_1_3_1","unstructured":"Allen J. Christie A. Fithen W. McHugh J. Pickel J. and Stoner E. 2001. Code Red Worm Exploiting Buffer Overflow In IIS Indexing Service DLL. Tech. rep. Carnegie Mellon Software Engineering Institute. (Aug.)  Allen J. Christie A. Fithen W. McHugh J. Pickel J. and Stoner E. 2001. Code Red Worm Exploiting Buffer Overflow In IIS Indexing Service DLL. Tech. rep. Carnegie Mellon Software Engineering Institute. (Aug.)"},{"volume-title":"IEEE Symposium on Field-Programmable Custom Computing Machines. IEEE","author":"Baker Z. K.","key":"e_1_2_1_4_1"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/362686.362692"},{"volume-title":"11th Conference on Field Programmable Logic and Applications. Springer-Verlag","author":"Braun F.","key":"e_1_2_1_6_1"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/40.988691"},{"key":"e_1_2_1_8_1","unstructured":"Broadcom Inc. 2001. Strada Switch II BCM5616---Integrated Multi-layer Switch. Broadcom Inc.  Broadcom Inc. 2001. Strada Switch II BCM5616---Integrated Multi-layer Switch. Broadcom Inc."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSSC.2000.911249"},{"volume-title":"IEEE Symposium on Field-Programmable Custom Computing Machines. IEEE","author":"Cho Y. H.","key":"e_1_2_1_10_1"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/1065579.1065641"},{"volume-title":"12th Conference on Field Programmable Logic and Applications. Springer-Verlag","author":"Cho Y. H.","key":"e_1_2_1_12_1"},{"volume-title":"International Conference on Field Programmable Logic and Applications (FPL)","author":"Clark C. R.","key":"e_1_2_1_13_1"},{"volume-title":"Scalable Parallel Pattern-Matching on High-Speed Networks. In IEEE Symposium on Field-Programmable Custom Computing Machines. IEEE","author":"Clark C. R.","key":"e_1_2_1_14_1"},{"key":"e_1_2_1_15_1","unstructured":"Desi N. 2002. Increasing performance in high speed NIDS: A look at Snort's internals.http:\/\/packetstorm.linuxsecurity.net\/papers\/IDs\/Increasing-Performance-NLDS.pdf.  Desi N. 2002. Increasing performance in high speed NIDS: A look at Snort's internals.http:\/\/packetstorm.linuxsecurity.net\/papers\/IDs\/Increasing-Performance-NLDS.pdf."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/MM.2004.1268997"},{"volume-title":"12th IEEE International Workshop on Rapid Prototyping. IEEE","author":"Dollas A.","key":"e_1_2_1_17_1"},{"volume-title":"Proceedings of the IEEE Symposium on FPGA's for Custom Computing Machines. IEEE","author":"Dowd P. W.","key":"e_1_2_1_18_1"},{"key":"e_1_2_1_19_1","unstructured":"Dubrawsky I. 2003. Firewall evolution - deep packet inspection. Infocus. http:\/\/www. security focus.com\/infocus\/1716.  Dubrawsky I. 2003. Firewall evolution - deep packet inspection. Infocus. http:\/\/www. security focus.com\/infocus\/1716."},{"volume-title":"10th Conference on Field Programmable Logic and Applications. Springer-Verlag","author":"Fallside H.","key":"e_1_2_1_20_1"},{"volume-title":"Proceedings of the IEEE Symposium on FPGA's for Custom Computing Machines. IEEE","author":"Franklin R.","key":"e_1_2_1_21_1"},{"key":"e_1_2_1_22_1","unstructured":"Gaudin S. 2003. Virus damage worst on record for August 2003. Cyber Atlas. http:\/\/itmanagement_earthweb.com\/secu\/article.php\/3071051.  Gaudin S. 2003. Virus damage worst on record for August 2003. Cyber Atlas. http:\/\/itmanagement_earthweb.com\/secu\/article.php\/3071051."},{"volume-title":"12th Conference on Field Programmable Logic and Applications. Springer-Verlag","author":"Gokhale M.","key":"e_1_2_1_23_1"},{"volume-title":"10th Conference on Field Programmable Logic and Applications. Springer-Verlag","author":"Iliopoulos M.","key":"e_1_2_1_24_1"},{"key":"e_1_2_1_25_1","unstructured":"Karagiannis M. 2001. How to create a stealth packet scrubber using Hogwash. Hogwash.org. http:\/\/www.mkgcs.com\/public\/hogwash.pdf.  Karagiannis M. 2001. How to create a stealth packet scrubber using Hogwash. Hogwash.org. http:\/\/www.mkgcs.com\/public\/hogwash.pdf."},{"key":"e_1_2_1_26_1","unstructured":"Lockwood J. Moscola J. Kulig M. Reddick D. and Brooks T. 2003. Internet worm and virus protection in dynamically reconfigurable hardware. In Military and Aerospace Programmable Logic Device (MAPLD). NASA Office of Logic Design Washington DC.  Lockwood J. Moscola J. Kulig M. Reddick D. and Brooks T. 2003. Internet worm and virus protection in dynamically reconfigurable hardware. In Military and Aerospace Programmable Logic Device (MAPLD). NASA Office of Logic Design Washington DC."},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.5555\/517089.871968"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/52.877859"},{"volume-title":"IEEE Symposium on Field-Programmable Custom Computing Machines. IEEE","author":"Moscola J.","key":"e_1_2_1_29_1"},{"volume-title":"International Conference on Field Programmable Logic and Applications (FPL)","author":"Papadopoulos G.","key":"e_1_2_1_30_1"},{"key":"e_1_2_1_31_1","unstructured":"PMC Sierra Inc. 2001. PM2329 ClassiPi Network Classification Processor Datasheet. PMC Sierra Inc.  PMC Sierra Inc. 2001. PM2329 ClassiPi Network Classification Processor Datasheet. PMC Sierra Inc."},{"volume-title":"USENIX LISA 1999 conference. USENIX, http:\/\/www.snort.org\/.","year":"1999","author":"Roesch M.","key":"e_1_2_1_32_1"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.5555\/1058426.1058885"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/FCCM.2005.11"},{"volume-title":"11th International Conference on Field Programmable Logic and Applications. Springer-Verlag","author":"Sinnappan R.","key":"e_1_2_1_35_1"},{"volume-title":"IEEE Symposium on Field-Programmable Custom Computing Machines. IEEE","author":"Sivilotti R.","key":"e_1_2_1_36_1"},{"volume-title":"13th Conference on Field Programmable Logic and Applications. Springer-Verlag","author":"Sourdis I.","key":"e_1_2_1_37_1"},{"volume-title":"IEEE Symposium on Field-Programmable Custom Computing Machines. IEEE","author":"Sourdis I.","key":"e_1_2_1_38_1"},{"volume-title":"International Conference on Field Programmable Logic and Applications (FPL)","author":"Sourdis I.","key":"e_1_2_1_39_1"},{"key":"e_1_2_1_40_1","unstructured":"Viacom Inc. 2001. Firewall Questions and Answers. Viacom Inc.  Viacom Inc. 2001. Firewall Questions and Answers. Viacom Inc."},{"volume-title":"Gigabit Rate Packet Pattern-Matching Using TCAM. In 12th IEEE International Conference on Network Protocols. IEEE","author":"Yu F.","key":"e_1_2_1_41_1"},{"volume-title":"10th Conference on Field Programmable Logic and Applications. Springer-Verlag","author":"Yusuf S.","key":"e_1_2_1_42_1"}],"container-title":["ACM Transactions on Embedded Computing Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1331331.1331345","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1331331.1331345","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T20:22:28Z","timestamp":1750278148000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1331331.1331345"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2008,1,29]]},"references-count":42,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2008,2]]}},"alternative-id":["10.1145\/1331331.1331345"],"URL":"https:\/\/doi.org\/10.1145\/1331331.1331345","relation":{},"ISSN":["1539-9087","1558-3465"],"issn-type":[{"type":"print","value":"1539-9087"},{"type":"electronic","value":"1558-3465"}],"subject":[],"published":{"date-parts":[[2008,1,29]]},"assertion":[{"value":"2004-07-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2006-11-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2008-01-29","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}