Characteristics of hardware-based field-programmable gate array implementation of network traffic analyzer for malicious code detection

M. Samoylov^a, D. Gamayunov^a, S. Bezzubtsev^b, M. Bulgakov<sup>a

a</sup> Faculty of Computational Mathematics and Cybernetics, M. V. Lomonosov Moscow State University
^b Lebedev Institute of Precision Mechanics and Computer Engineering, Russian Academy of Sciences

Abstract: The paper is dedicated to improvement of perfomance charachteristics of existing malicious network traffic analyzing algorithms on high-speed network interfaces. The Racewalk algorithm is considered as a base for research. The authors focus on offloading certain processing actions into specific dedicated hardware device. As seen from experimental results, such implementation can work on higher network interface speeds (i. e., 10 Gbit/s).

Keywords: FPGA; Racewalk; traffic filtering; shellcodes; network traffic.