Hardware-Based 'on-the-fly' Per-flow Scan Detector Pre-filter (Poster)
| Autor: | Simone Teofili, Salvatore Pontarelli, Giuseppe Bianchi |
|---|---|
| Rok vydání: | 2011 |
| Předmět: |
Computer science
business.industry Real-time computing Detector 020206 networking & telecommunications 020302 automobile design & engineering 02 engineering and technology Filter (signal processing) Modular design Data structure 0203 mechanical engineering 0202 electrical engineering electronic engineering information engineering Key (cryptography) business Field-programmable gate array Computer hardware |
| Zdroj: | Traffic Monitoring and Analysis ISBN: 9783642203046 TMA |
| DOI: | 10.1007/978-3-642-20305-3_17 |
| Popis: | Pre-filtering monitoring tasks, directly running over traffic probes, may accomplish a significant degree of data reduction by isolating a relatively small number of flows (likely to be of interest for the monitoring application) from the rest of the traffic. As these filtering mechanisms are conveniently run as close as possible to the data gathering devices (traffic probes), and must scale to multi-gigabit speed, the feasibility of their implementation in hardware is a key requirement. In this paper, we document a hardware FPGA implementation of a recently proposed network scan pre-filter. It leverages processing stages based on Bloom filters and Counting Bloom Filters, and it is devised to detect, through on-the-fly per-packet analysis, the flows which potentially exhibit a network/port scanning behaviour. The framework has been implemented in a modular manner. It suitably combines two different general-purpose modules (a rate meter and a variation detector) likely to be reused as building blocks for other monitoring tasks. In the following presentation, we further discuss some lessons learned and general implementation guidelines which emerge when the goal is to efficiently implement run-time updated (i.e., dynamic) Bloom-filter-based data structures in hardware |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|