Team [Ii][Ss][Uu][0–2]{4} design overview: MEMOCODE 2010 design contest

This paper describes the architecture of a high-speed regular expression matching system implemented by the [Ii][Ss][Uu][0-2]{4} team from Iowa State University for the 2010 MEMOCODE competition. The purpose of this system is to detect malicious patterns in high-speed network data streams. The core functionality is implemented on a Stratix III 260 FPGA, and software running on a Xeon processor is used to transfer data to/from main memory and the FPGA. An interesting aspect of this architecture is the novel use of context switching resources to avoid buffering packets of connections whose classification are pending. The implemented solution detects malicious patterns at over 500 Mbps, and is estimated to scale to support well over 400 rules on our Stratix III FPGA.