Implementation of bloom filters in reconfigurable hardware for tracing network attacks

A Bloom filter is a data structure for representing a set of strings in order to support membership queries, It was first introduced in 1970 for the database query matching. Recently this structure has been rediscovered and widely used in the area of network processing. The main problems that can he solved using the Bloom filters are: datagram tracehack, multi pattern matching, packet classification and malicious code fingerprinting. In the article we will describe our experiences with the implementation of Bloom filters in Field-Programmable Gate Arrays for tracing network attacks. The prepared module can operate with the throughput over 1 Gbps and can store up to 5 seconds of traffic using less than 262, 144 kB of memory.