Comparative analysis of approaches to the building of reconfigurable security tools components

Abstract

This paper investigates the approaches to hardware implementation on the reconfigurable (based on FPGAs) signature-based security tools, which in real time solve computationally resource-intensive problem of multi-pattern matching in an intensive input data stream (intrusion detection systems, anti-virus and anti-spam tools). In order to assess the properties of such tools and their components, as well as to compare different approaches to recognition schemes building, the performance indicators are identified and classified. It was found that the most effective in the construction of hardware schemes for multi-pattern matching are the following three approaches and corresponding underlying technologies: associative memory based on digital comparators; Bloom filter based on hash functions; Aho–Corasik algorithm based on finite automata. A qualitatively formalized review in terms of correspondent indicators is provided for each of these directions. The features of its implementation on FPGA, the difficulties and problems that arise, and ways to eliminate them are investigated as well. A comparative analysis of these approaches was performed. It is concluded that none of them demonstrates clear advantages over others, so the methods to combine different approaches in a single device, maximizing efficiency by realizing their advantages, are needed.