A High-Throughput FPGA Architecture for Real-Time TCP-SYN Scan Detection

2026-09-12

AI Summary

该研究提出了一种轻量级FPGA架构，用于实时TCP-SYN扫描检测，通过布尔LUT树并行评估指纹，实现了低延迟和高吞吐量。

Abstract

TCP-SYN port scanning often precedes cyber-attacks, and early detection of scanner fingerprints embedded in packet headers can provide timely intrusion alerts. Existing approaches are either too computationally expensive for line-rate operation or limited to offline analysis. This brief presents a lightweight FPGA architecture for reconfigurable line-rate fingerprint detection, where each fingerprint is compiled into a shallow Boolean LUT tree, enabling parallel evaluation with constant two-cycle latency regardless of fingerprint count, while resource cost grows linearly with fingerprint count. This detection core is decoupled from a MAC-layer frontend that performs streaming field extraction with no frame buffering or higher-layer state, allowing deployment across different line rates by modifying only the frontend. A Python framework automatically compiles Boolean expressions into synthesizable HDL, eliminating manual RTL changes. For TCP-SYN port-scan fingerprint detection, the architecture uses approximately 0.5% LUTs at 10 Gbps on a Versal VCK190 for 18 deployed fingerprints, with capacity for over 2,000 concurrent fingerprints, and under 2.5% on a Virtex-6 at 1 Gbps, with a detection latency of 10 ns at both rates, three to four orders of magnitude below typical per-packet processing latency in software intrusion-detection systems. The system was cross-validated against a software re-implementation on an 8-hour production packet trace, confirming detection correctness with zero false positives/negatives.

Problem

• TCP-SYN scan
• real-time detection
• line-rate operation
• intrusion alerts
• fingerprint detection

Innovation

• FPGA Architecture
• Real-Time Detection
• Boolean LUT Tree
• Reconfigurable Line-Rate
• Automatic Compilation