"FPGA Design of IP Packet Filter based on SNORT rules"

Abstract

Contemporary technology advances increase the pace of rapid expansion of the number of computers and devices connected to the Internet on а daily basis. Therefore, one of the highest priority issues that need to be considered in this enormous network is the network security. The greater the number of connected users and devices, the attempts to invade privacy and data of connected users becomes more and more tempting to hostile users. Thus, Network Intrusion Detection Systems (NIDS) become more and more necessary in any network device connected to the Internet, and are taking the lead in the battle against intruders. This paper addresses the network security issues by implementing NIDS style hardware implementation network packet filter intended to provide fast packet processing and filtering. The hardware is based on several NIDS rules that can be programmed in the system's memory, thus enabling modularity and flexibility. The designed hardware unit is described in VHDL and implemented in a Virtex7 VC709 FPGA board. The simulation timing diagrams and FPGA synthesis (implementation) reports are discussed and analyzed in this paper.