摘要： 针对模式匹配软件算法速度慢、正确率低等问题，提出一种基于FPGA的硬件多模式匹配算法，通过设计窗口折叠的布鲁姆过滤器，有效减小资源消耗。与多级确认机制结合可降低虚警率，并采用不同于传统方式的并行结构提高查询速度，实现高效率无虚警的精确模式匹配。实验结果表明，采用该算法的高速入侵检测系统吞吐率可达到10 Gb/s。

关键词: 布鲁姆过滤器, 入侵检测, 模式匹配, 现场可编程门阵列, 流水线结构

Abstract: In view of the low efficiency of software performance in multi-pattern matching algorithm, a new hardware-based solution based on Field Programmable Gate Array(FPGA) is proposed. By using Bloom Filter(BF) data window collapsing, the on-chip hardware resource consumption is reduced and efficiency is improved. To reduce the possibility of false positive, the multilevel-verification is applied. A pipeline parallel structure is used to improve the query efficiency, which makes the pattern matching work in the high performance with no false positive. The method is applied in a high-speed network intrusion detection system. Experimental result shows that the throughout of system can reach the line speed of 10 Gb/s.

Key words: Bloom Filter(BF), intrusion detection, pattern matching, Field Programmable Gate Array(FPGA), pipeline structure

中图分类号: 

• TP303