Aggregated bloom filters for intrusion detection and prevention hardware

N. Sertac Artan, Kaustubh Sinkar, Jalpa Patel, H. Jonathan Chao

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Bloom Filters (BFs) are fundamental building blocks in various network security applications, where packets from high-speed links are processed using state-of-the-art hardware-based systems. In this paper, we propose Aggregated Bloom Filters (ABFs) to increase the throughput and scalability of BFs. The proposed ABF has two methods to improve average speed and scalability. The first method leverages the query mechanism for hardware BFs. We ptimize queries by removing redundant hash calculations and memory accesses. First, to remove redundancy, the hash functions for each query are calculated sequentially. As soon as we have a no match in any of the hash results, the query is immediately abandoned. We then aggregate multiple queries and query a BF with all of these queries in parallel, which maximizes the throughput of the BF. The second method addresses scalability issues regarding the on-chip memory resources. In most applications multiple BFs are required to store many sets with different numbers of elements. These sets may also be too small for the unit memory on-chip. So, most of the memory is left unused, causing low memory utilization. The second method aggregates small distributed BFs to a single BF allowing better on-chip memory utilization. For the application of Network Intrusion Detection and Prevention Systems (NIDPSs), our proposed ABF shows seven-fold improvement in the average query throughput and four times less memory usage.

Original languageEnglish (US)
Title of host publicationIEEE GLOBECOM 2007 - 2007 IEEE Global Telecommunications Conference, Proceedings
Pages349-354
Number of pages6
DOIs
StatePublished - 2007
Event50th Annual IEEE Global Telecommunications Conference, GLOBECOM 2007 - Washington, DC, United States
Duration: Nov 26 2007Nov 30 2007

Publication series

NameGLOBECOM - IEEE Global Telecommunications Conference

Other

Other50th Annual IEEE Global Telecommunications Conference, GLOBECOM 2007
CountryUnited States
CityWashington, DC
Period11/26/0711/30/07

ASJC Scopus subject areas

  • Engineering(all)

Fingerprint Dive into the research topics of 'Aggregated bloom filters for intrusion detection and prevention hardware'. Together they form a unique fingerprint.

  • Cite this

    Artan, N. S., Sinkar, K., Patel, J., & Chao, H. J. (2007). Aggregated bloom filters for intrusion detection and prevention hardware. In IEEE GLOBECOM 2007 - 2007 IEEE Global Telecommunications Conference, Proceedings (pp. 349-354). [4410982] (GLOBECOM - IEEE Global Telecommunications Conference). https://doi.org/10.1109/GLOCOM.2007.72