Realtime Malicious Traffic Detection Targeted for TCP Out-of-Order Packets Based on FPGA
Currently, with the increasing popularity of high-speed network, in order to protect the network environment, more and more companies start to explore how to efficiently detect malicious traffic. On the software side, traditional detection systems are usually based on CPU which will consume multi-co...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2023-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10278400/ |
| _version_ | 1797658021511299072 |
|---|---|
| author | Zhenguo Hu Hirokazu Hasegawa Yukiko Yamaguchi Hajime Shimada |
| author_facet | Zhenguo Hu Hirokazu Hasegawa Yukiko Yamaguchi Hajime Shimada |
| author_sort | Zhenguo Hu |
| collection | DOAJ |
| description | Currently, with the increasing popularity of high-speed network, in order to protect the network environment, more and more companies start to explore how to efficiently detect malicious traffic. On the software side, traditional detection systems are usually based on CPU which will consume multi-core processing ability to handle huge network traffic. On the hardware side, current researches focus on using specific hardware to offload some functions such as string matching in malicious traffic detection. However, they cannot detect attack behaviors hidden in TCP out-of-order (OOO) packets well, which are very common in modern complex network environments. To deal with this problem, we present an FPGA-based realtime malicious traffic detection method especially to inspect TCP OOO packets. It employs two core function designs for efficient malicious traffic inspection: TCP OOO reassembly and hierarchical packet match. First, the TCP OOO packets are reassembled to in-order packets to prevent the omission check of malicious traffic. Second, we adapt a hierarchical packet match design which can not only detect the packet header and filter the matching traffic, but also has the ability to inspect the carried payload to further determine whether the traffic is benign or malicious. We use Xilinx Alveo U50 accelerator card as the implementation platform to achieve high speed detection. This paper aims to provide a full detection path and implement all the reassembly and inspection process within an FPGA board. We adapt Cisco TRex as the traffic generator to evaluate the system from detection throughput, resource utilization and power consumption. Compared with the CPU-based approaches, the experiment results show that our system has 485% detection throughput increase and 68% average power decrease. |
| first_indexed | 2024-03-11T17:53:06Z |
| format | Article |
| id | doaj.art-64b996bc31d643ce9668dcb37c8b39a9 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-03-11T17:53:06Z |
| publishDate | 2023-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-64b996bc31d643ce9668dcb37c8b39a92023-10-17T23:00:25ZengIEEEIEEE Access2169-35362023-01-011111221211222210.1109/ACCESS.2023.332385310278400Realtime Malicious Traffic Detection Targeted for TCP Out-of-Order Packets Based on FPGAZhenguo Hu0https://orcid.org/0009-0005-1889-0720Hirokazu Hasegawa1Yukiko Yamaguchi2Hajime Shimada3Graduate School of Informatics, Nagoya University, Nagoya, JapanCenter for Strategic Cyber Resilience Research and Development, National Institute of Informatics, Tokyo, JapanInformation Technology Center, Nagoya University, Nagoya, JapanInformation Technology Center, Nagoya University, Nagoya, JapanCurrently, with the increasing popularity of high-speed network, in order to protect the network environment, more and more companies start to explore how to efficiently detect malicious traffic. On the software side, traditional detection systems are usually based on CPU which will consume multi-core processing ability to handle huge network traffic. On the hardware side, current researches focus on using specific hardware to offload some functions such as string matching in malicious traffic detection. However, they cannot detect attack behaviors hidden in TCP out-of-order (OOO) packets well, which are very common in modern complex network environments. To deal with this problem, we present an FPGA-based realtime malicious traffic detection method especially to inspect TCP OOO packets. It employs two core function designs for efficient malicious traffic inspection: TCP OOO reassembly and hierarchical packet match. First, the TCP OOO packets are reassembled to in-order packets to prevent the omission check of malicious traffic. Second, we adapt a hierarchical packet match design which can not only detect the packet header and filter the matching traffic, but also has the ability to inspect the carried payload to further determine whether the traffic is benign or malicious. We use Xilinx Alveo U50 accelerator card as the implementation platform to achieve high speed detection. This paper aims to provide a full detection path and implement all the reassembly and inspection process within an FPGA board. We adapt Cisco TRex as the traffic generator to evaluate the system from detection throughput, resource utilization and power consumption. Compared with the CPU-based approaches, the experiment results show that our system has 485% detection throughput increase and 68% average power decrease.https://ieeexplore.ieee.org/document/10278400/FPGAhardware accelerationmalicious traffic detection |
| spellingShingle | Zhenguo Hu Hirokazu Hasegawa Yukiko Yamaguchi Hajime Shimada Realtime Malicious Traffic Detection Targeted for TCP Out-of-Order Packets Based on FPGA IEEE Access FPGA hardware acceleration malicious traffic detection |
| title | Realtime Malicious Traffic Detection Targeted for TCP Out-of-Order Packets Based on FPGA |
| title_full | Realtime Malicious Traffic Detection Targeted for TCP Out-of-Order Packets Based on FPGA |
| title_fullStr | Realtime Malicious Traffic Detection Targeted for TCP Out-of-Order Packets Based on FPGA |
| title_full_unstemmed | Realtime Malicious Traffic Detection Targeted for TCP Out-of-Order Packets Based on FPGA |
| title_short | Realtime Malicious Traffic Detection Targeted for TCP Out-of-Order Packets Based on FPGA |
| title_sort | realtime malicious traffic detection targeted for tcp out of order packets based on fpga |
| topic | FPGA hardware acceleration malicious traffic detection |
| url | https://ieeexplore.ieee.org/document/10278400/ |
| work_keys_str_mv | AT zhenguohu realtimemalicioustrafficdetectiontargetedfortcpoutoforderpacketsbasedonfpga AT hirokazuhasegawa realtimemalicioustrafficdetectiontargetedfortcpoutoforderpacketsbasedonfpga AT yukikoyamaguchi realtimemalicioustrafficdetectiontargetedfortcpoutoforderpacketsbasedonfpga AT hajimeshimada realtimemalicioustrafficdetectiontargetedfortcpoutoforderpacketsbasedonfpga |