A High Throughput Bloom Filter Based TCAM Architecture for Fast NIDS

One of the computationally most intensive tasks of an Network Intrusion Detection System (NIDS) is string/pattern matching where the payload of incoming packet is compared against predefined rule-set in order to detect any intrusion or threat. Although, various software algorithms and hardware architectures have been proposed to accelerate the performance of NIDS, wire-speed matching of these patterns still remains as a challenge. TCAMs are popularly used in many networking applications as they can perform the pattern matching in single clock cycle, but they always suffer with high power dissipation and delay due to their complex circuitry. Hence, most of the research focuses on efficient utilization of TCAM to cope up with high-speed links. In this paper, a high-throughput TCAM based architecture employed with Bloom filters is proposed. When a Bloom filter is deployed with TCAM, the number of patterns to be matched on TCAM reduces significantly since most of the patterns are eliminated in the prefiltering stage. There exist various Bloom filters such as Standard Bloom filter [1], Cuckoo filters [2], Counting Bloom filters [3] and Compressed filters [4]. Our proposed variant of Bloom filter outperforms all the existing filters in terms of speed while using less memory. We performed experiments on widely used open-source Snort NIDS and the proposed approach is able to achieve a throughput of 128Gbps for version 3.0c and 77.5Gbps for version 2.9.17.