Research on range matching for wire-speed hardware NIDS - CHEN Shu-hui; SUN Zhi-gang; SU Jin-shu (Tongxin xuebao)
To solve the rule matching problem of hardware NIDS,a range matching algorithm LRC-RM was proposed,with more efficient memory utilization.The approach mapped the port range into a compressed bit vector and organized the bit vectors as an extended balanced binary tree.Experiments were employed to show that NIDS using this approach can perform wire-speed range matching for OC-192 links,while saving 99% memory resource comparing to the existing methods.The algorithm is easy to be implemented within a chip without additional RAM.