Design of a Heterogeneous-Based Network Intrusion Detection System and Compiler
Source abstract
Abstract
With the continuous growth of network traffic scale, traditional software-based intrusion detection systems (IDS) constrained by CPU-processing capabilities struggle to meet the requirements of 100 Gbps high-speed network environments. While existing heterogeneous acceleration solutions enhance detection efficiency through hardware acceleration, they still exhibit technical limitations including insufficient throughput, simplistic task offloading mechanisms, and poor compatibility in rule compilation. This paper is based on the collaborative design consept of “hardware-accelerated preprocessing + software-based precise detection”, fully leveraging FPGA’s parallel processing capabilities and CPU’s flexible computation advantages. We construct an FPGA + CPU heterogeneous detection system featuring a five-tuple segmented matching architecture, which integrates hash bitmap and shift-or algorithms to achieve fast-pattern matching. A hardware compiler supporting 10,000+ detection rules is developed, enhancing hardware adaptability through packet optimization and mask compilation. Experimental results demonstrate that the system maintains 100 Gbps throughput with 2000–10,000 rule sets, achieves over 97% detection accuracy, and consumes only 33% hardware logic resources. Compared with Snort software implementation on equivalent configurations, it delivers 10.5–27.1 times throughput improvement, providing an efficient and reliable solution for real-time intrusion detection in high-speed networks.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Packet Processing and Optimization · Network Security and Intrusion Detection · Algorithms and Data Compression
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Electronics and Information Engineering, Tiangong University, Tianjin 300387, China
School of Computer and Information Engineering, Tianjin Chengjian University, Tianjin 300384, China
School of Life Sciences, Tiangong University, Tianjin 300387, China
References (42)
Show source-provided references
1. Hoover, C. (2022). Comparative Study of Snort 3 and Suricata Intrusion Detection Systems. [Bachelor’s Thesis, University of Arkansas].
2. Li, X. (2022, January 21–23). Research and design of network intrusion detection system. Proceedings of the 2022 IEEE 2nd International Conference on Power, Electronics and Computer Applications (ICPECA), Shenyang, China.10.1109/ICPECA53709.2022.9718920 ↗
3. Farooq, M.A., Rafique, A., Fahmy, S.A., and Arora, A. (2024, January 3–5). High Throughput Low Latency Network Intrusion Detection on FPGAs: A Raw Packet Approach. Proceedings of the 2025 ACM/SIGDA International Symposium on Field Programmable Gate Arrays, Monterey, CA, USA.10.1145/3706628.3708844 ↗
4. Roesch, M. (1999, January 7–12). Snort: Lightweight intrusion detection for networks. Proceedings of the LISA ’99: 13 th Systems Administration Conferenc, Seattle, WA, USA.
5. Proactive DDoS attack detection in software-defined networks with Snort rule-based algorithms
6. CNN-BiLSTM: A hybrid deep learning approach for network intrusion detection system in software-defined networking with hybrid feature selection10.1109/ACCESS.2023.3340142 ↗
7. Shpur, O., Klymash, M., Holdiy, A., and Kopets, H. (2024, January 8–12). IDPS System Building Approach with Support and Update of Attack Detection Rules. Proceedings of the 2024 IEEE 17th International Conference on Advanced Trends in Radioelectronics, Telecommunications and Computer Engineering (TCSET), Lviv, Ukraine.10.1109/TCSET64720.2024.10755674 ↗
8. Design and implementation of an intrusion detection system by using extended BPF in the Linux kernel10.1016/j.jnca.2021.103283 ↗
9. Poisoning the well: Adversarial poisoning on ML-based software-defined network intrusion detection systems10.1109/TNSE.2024.3492032 ↗
10. On high-speed flow-based intrusion detection using snort-compatible signatures10.1109/TDSC.2020.2973992 ↗
11. Morianos, I., Georgopoulos, K., Brokalakis, A., Kyriakakis, T., and Ioannidis, S. (July, January 30). I2DS: FPGA-Based Deep Learning Industrial Intrusion Detection System. Proceedings of the International Conference on Embedded Computer Systems: Architectures, Modeling, and Simulation, Samos, Greece.
12. Advancing Snort IPS to Achieve Line Rate Traffic Processing for Effective Network Security Monitoring10.1109/ACCESS.2024.3395123 ↗
13. Chen, J., Zhang, X., Wang, T., Zhang, Y., Chen, T., Chen, J., Xie, M., and Liu, Q. (2022, January 18–22). Fidas: Fortifying the cloud via comprehensive FPGA-based offloading for intrusion detection: Industrial product. Proceedings of the 49th Annual International Symposium on Computer Architecture, New York, NY, USA.10.1145/3470496.3533043 ↗
14. Vasiliadis, G., Antonatos, S., Polychronakis, M., Markatos, E.P., and Ioannidis, S. (2008, January 15–17). Gnort: High performance network intrusion detection using graphics processors. Proceedings of the Recent Advances in Intrusion Detection: 11th International Symposium, RAID 2008, Cambridge, MA, USA. Proceedings 11.
15. Zhao, Z., Sadok, H., Atre, N., Hoe, J.C., Sekar, V., and Sherry, J. (2020, January 4–6). Achieving 100gbps intrusion prevention on a single server. Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20), Online.
16. Košař, V., Šišmiš, L., Matoušek, J., and Kořenek, J. (2023, January 9–12). Accelerating IDS using TLS pre-filter in FPGA. Proceedings of the 2023 IEEE Symposium on Computers and Communications (ISCC), Gammarth, Tunisia.10.1109/ISCC58397.2023.10218049 ↗
17. Shaik, S., and SK, N.M. (2024, January 6–7). A High Throughput Bloom Filter Based TCAM Architecture for Fast NIDS. Proceedings of the 2024 International Conference on Smart Electronics and Communication Systems (ISENSE), Kottayam, India.10.1109/ISENSE63713.2024.10872149 ↗
18. Yalçın, S.S. (2024). An FPGA-Accelerated String-Matching Engine. [Master’s Thesis, Middle East Technical University].
19. Hardware/Software Codesign of Real-Time Intrusion Detection System for Internet of Things Devices10.1109/JIOT.2024.3380822 ↗
20. Energy-Efficient CPU+ FPGA-based CNN Architecture for Intrusion Detection Systems10.1109/MCE.2023.3283730 ↗
21. Enhancing detection of malicious traffic through fpga-based frequency transformation and machine learning10.1109/ACCESS.2023.3348234 ↗
22. Hu, Z., Hasegawa, H., Yamaguchi, Y., and Shimada, H. (2025, April 24). Heterogeneous Network Inspection in IoT Environment with FPGA Based Pre-Filter and CPU Based LightGBM. Available online: https://personales.upv.es/thinkmind/dl/conferences/securware/securware_2023/securware_2023_1_60_30040.pdf.
23. Ngo, D.M., Lightbody, D., Temko, A., Pham-Quoc, C., Tran, N.T., Murphy, C.C., and Popovici, E. (2023). HH-NIDS: Heterogeneous hardware-based network intrusion detection framework for IoT security. Future Internet, 15.10.3390/fi15010009 ↗
24. Bao, T.H.Q., Le, L.T., Thinh, T.N., and Pham, C.K. (2022, January 17–19). A High-Performance FPGA-Based Feature Engineering Architecture for Intrusion Detection System in SDN Networks. Proceedings of the International Conference on Intelligence of Things, Hanoi, Vietnam.10.1007/978-3-031-15063-0_24 ↗
25. Liu, Y., Xu, D., Liu, D., and Sun, L. (2009, January 23–25). A fast and configurable pattern matching hardware architecture for intrusion detection. Proceedings of the 2009 Second International Workshop on Knowledge Discovery and Data Mining, Moscow, Russia.10.1109/WKDD.2009.111 ↗
26. FPGA-CPU architecture accelerated regular expression matching with fast preprocessing10.1093/comjnl/bxac138 ↗
27. Callanan, D., Kljucaric, L., and George, A. (2021, January 27–29). Accelerating regular-expression matching on fpgas with high-level synthesis. Proceedings of the 9th International Workshop on OpenCL, Munich, Germany.10.1145/3456669.3456716 ↗
28. Efnusheva, D., Cholakoska, A., and Kalendar, M. (2025, April 24). FPGA Design of IP Packet Filter Based on SNORT Rules. Available online: https://www.eventiotic.com/eventiotic/files/Papers/URL/f3ba528f-4e75-4d67-b2ec-960c2c3e92ed.pdf.
29. FPGA-assisted DPI systems: 100 Gbit/s and beyond10.1109/COMST.2018.2876196 ↗
30. Fpga-based multicore architecture for integrating multiple ddos defense mechanisms10.1145/3039902.3039906 ↗
31. Wang, X., Hong, Y., Chang, H., Park, K., Langdale, G., Hu, J., and Zhu, H. (2019, January 26–28). Hyperscan: A fast multi-pattern regex matcher for modern CPUs. Proceedings of the 16th USENIX Symposium on Networked Systems Design and Implementation (NSDI 19), Boston, MA, USA.
32. Zhou, J., and Ross, K.A. (2002, January 3–6). Implementing database operations using SIMD instructions. Proceedings of the 2002 ACM SIGMOD International Conference on Management of Data, Madison, WI, USA.10.1145/564691.564709 ↗
33. Mitra, A., Najjar, W., and Bhuyan, L. (2007, January 3–4). Compiling pcre to fpga for accelerating snort ids. Proceedings of the 3rd ACM/IEEE Symposium on Architecture for Networking and Communications Systems, Orlando, FL, USA.10.1145/1323548.1323571 ↗
34. Zhong, J., Chen, S., and Yu, C. (2024). XAV: A High-Performance Regular Expression Matching Engine for Packet Processing. arXiv.10.2139/ssrn.4760269 ↗
35. Cicolini, L., Carloni, F., Santambrogio, M.D., and Conficconi, D. (2024, January 2–6). One Automaton to Rule Them All: Beyond Multiple Regular Expressions Execution. Proceedings of the 2024 IEEE/ACM International Symposium on Code Generation and Optimization (CGO), Edinburgh, UK.10.1109/CGO57630.2024.10444810 ↗
36. Woodruff, J., Ainsworth, S., and O’Boyle, M.F. (2024, January 22–25). Secco: Codesign for Resource Sharing in Regular-Expression Accelerators. Proceedings of the 2024 29th Asia and South Pacific Design Automation Conference (ASP-DAC), Incheon, Republic of Korea.10.1109/ASP-DAC58780.2024.10473854 ↗
37. Song, H., and Lockwood, J.W. (2005, January 20–22). Efficient packet classification for network intrusion detection using FPGA. Proceedings of the 2005 ACM/SIGDA 13th International Symposium on Field-Programmable Gate Arrays, Monterey, CA, USA.10.1145/1046192.1046223 ↗
38. Fuller, V., Li, T., Yu, J., and Varadhan, K. (2025, April 24). Classless Inter-Domain Routing (CIDR): An Address Assignment and Aggregation Strategy. Report 2070-1721. Available online: https://dl.acm.org/doi/abs/10.17487/rfc1519.
39. Yang, T., Yin, B., Li, H., Shahzad, M., Uhlig, S., Cui, B., and Li, X. (2017, January 11–14). Rectangular hash table: Bloom filter and bitmap assisted hash table with high speed. Proceedings of the 2017 IEEE International Conference on Big Data (Big Data), Boston, MA, USA.10.1109/BigData.2017.8257999 ↗
40. Sun, H., Sun, Y., Valgenti, V.C., and Kim, M.S. (2015, January 16–19). A highly deterministic hashing scheme using bitmap filter for high speed networking. Proceedings of the 2015 International Conference on Computing, Networking and Communications (ICNC), Garden Grove, CA, USA.10.1109/ICCNC.2015.7069445 ↗
41. A new approach to text searching10.1145/135239.135243 ↗
42. Abdulhammed, R., Musafer, H., Alessa, A., Faezipour, M., and Abuzneid, A. (2019). Features dimensionality reduction approaches for machine learning based network intrusion detection. Electronics, 8.10.3390/electronics8030322 ↗