Evaluation of the Huffman Encoding for Memory Optimization on Hardware Network Intrusion Detection

The design of specialized hardware for Network Intrusion Detection has been subject of intense research over the last decade due to its considerably higher performance compared to software implementations. In this context, one of the limiting factors is the finite amount of memory resources versus the increasing number of threat patterns to be analyzed. This paper proposes an architecture based on the Huffman algorithm for encoding, storage and decoding of these patterns in order to optimize such resources. We have made tests with simulation and synthesis in FPGA of rule subsets of the Snort software, and analysis indicate a saving of up to 73 percent of the embedded memory resources of the chip.