A network intrusion detection system on IXP1200 network processors with support for large rule sets

Abstract

In this paper we describe an network intrusion detection system implemented on the IXP1200 network processor. It is aimed at detecting worms at high speeds by matching the payload of network packets against worm signatures at the lowest possible levels of the processing hierarchy (the microengines of an IXP1200 network processor). The solution employs the AhoCorasick algorithm in a parallel fashion, where each microengine processes a subset of the network traffic. To allow for large patterns as well as a large number of rules, the signatures are stored in off-chip memory. Using an old version of the IXP network processors (the IXP1200), the system is capable of handling close to 200 Mbps with full content scan for realistic threats.