以Microblaze處理器為基礎的網路入侵偵測系統之FPGA硬體電路實現

Abstract

目前的網路入侵偵測研究中，主要都是以找到好的演算法來設計快速的硬體比對電路為主，鮮少有於系統方面的探討，本論文希望除了針對電路層面的研究外，也能將其實現成系統，將電路以模組化的方式掛在系統上，成為系統中最重要的核心技術。緊接著我們希望從系統層面來觀看，提出兩種不同架構來做比較，瞭解在使用不同的Buffer來傳輸時，對整體的系統效能的影響性，不管是在System Throughput或者是System Transmission Latency Time的表現上，都會是我們發展入侵偵測系統的一些參考指標。最後在實驗部分，我們希望將整個系統建構在一個乾淨的網路環境底下，以避免量測上得誤差，並利用流量產生工具實際送出攻擊封包以對數據做量測。

Existing researches on network intrusion detection system often focus on the design of a fast pattern matching circuit instead of a discussion for the whole system. This paper not only looks into the circuit level but also implements a complete system. The fast pattern matching circuit, which is the core technique for detection, will be embedded as a module in the system. We proposed two different architectures and provided a system-level comparison. We use System Throughput and System Transmission Latency Time as the reference targets to find out the impact of using different buffers to transmit on system performance. In experiments, we setup the detection system in a clean environment to prevent the measurement error, and do the measurements by using the network traffic generation tool to send attack packets.