Enhanced FPGA-based architecture for regular expression matching in NIDS

Abstract

Perl Compatible Regular Expression (PCRE) is increasingly used in Network Intrusion Detection System due to its efficiency. However, there are many issues that have not been completely solved for PCRE matching on hardware platform. In this paper, we propose an FPGA-based PCRE matching architecture that effectively improves the constraint repetition, an importance feature of PCRE. We enhance our architecture to handle m flag which is a powerful PCRE modifier. Besides, a toolchain for auto-generating PCRE matching engine is also implemented. Our experimental results on low-cost Altera Cyclone II chip shows that our architecture can achieve throughput up to 1Gbps and save up to 92.74% hardware resource as compared with the conventional architecture.