A Low-Energy Variation-Tolerant Asynchronous TCAM for Network Intrusion Detection Systems

This paper introduces a low-energy variation-tolerant asynchronous ternary content-addressable memory (TCAM) for Network Intrusion Detection Systems (NIDS). The proposed special-purpose TCAM can detect packet payloads as "virus free" by inspecting only a few bytes. Hence, it adaptively cancels unnecessary searches, leading to greatly reduction in the search delay time and energy dissipation. For timing robustness with low area overhead, a word circuit that stores a virus pattern is designed based on both a quasi-delay insensitive (QDI) and a bundled-data techniques. The QDI word circuit is realized by combining complementary word circuits for only a small portion of the TCAM that is sensitive to delay variations. For performance evaluation, a probability of the virus detection is calculated using a set of real packet traces from MIT DARPA. A 2048 × 128-byte asynchronous TCAM is designed using TSMC 65nm CMOS technology. The energy dissipation is 93.1% lower and the cycle time is 52.4% lower than those of a deep-pipelined synchronous TCAM with a comparable area. It is also demonstrated that the proposed TCAM tolerates up to 47% variations (3s) of threshold voltages.