# Design of a Heterogeneous-Based Network Intrusion Detection System and Compiler
## 3 Materials and Methods
### Design of CPU-Based Intrusion Detection and Rule Compilation
#### 3.3.1 Rule Compilation Module  
This module compiles Snort rule data into segmented memory files for FPGA-based matching. To enhance overall matching efficiency and optimize FPGA memory utilization, the rule set undergoes preprocessing and compilation workflow optimization. The implementation integrates five-tuple segmented matching and fast-pattern bit-parallel matching designs. As illustrated in Figure 3, when a Snort rule set is loaded into the compilation module, rule parsing is first executed to extract and convert fields such as five-tuple (source/destination IP/port, protocol) and content. Subsequent pattern processing and rule optimization steps involve field splitting, wildcard expansion, and rule merging. A concrete example is provided to elucidate the compilation design. After parsing, the five-tuple information and SID are fed into the five-tuple compilation submodule (e.g., variables like $HOME_NET, $EXTERNAL_NET, and $SIP_PORTS are predefined in Lua configuration files and resolved during parsing). The compilation process handles ports, protocols, and IPs as follows:  
**Port Compilation. ** Snort rules define ports as three types: exact port numbers, port ranges, or any. To address mixed port specifications, an interval prefix mask is employed to partition ranges into subintervals and detect source/destination port matches. Since multiple rules may share overlapping port ranges, the compiler dynamically updates source/destination port rule tables, encoding matched rules as \"address + offset\" entries for efficient lookup. As shown in Figure 4, for a rule with src_port: 80-1680, dst_port: 36-80, and sid = 4973, the compiler splits the source/destination port ranges into subintervals, computes maximal prefix masks, and inserts the rule ID into corresponding port tables. Addresses and offsets in the port tables are updated to reflect all matching rules. **Protocol and IP Compilation. ** Snort rules include four protocol types: UDP, TCP, ICMP, and IP. To improve matching efficiency, we designed a \"protocol + IP\" compilation mode: distinguishing IP lookup tables by protocols to narrow the scope of IP matching. The four protocols are represented as \"0x01, 0x02, 0x03, and 0x04\", respectively. The IP address types in rule files are divided into precise IP addresses, CIDR [38] addresses, and IP lists. Due to their complexity, we uniformly convert IP addresses to CIDR format  
Figure 3: Rule compilation process. during compilation, store them in protocol-specific CIDR tables, and establish a rule table to store two groups of corresponding CIDR addresses and rule IDs to match the relevant rules. As shown in Figure 5, we detail this compilation design through the example rule \"protocol:tcp, src_IP: 192.168.1.0/24, dst_IP: 10.0.0.5, sid = 4973\":  
First, classify according to the protocol type in the rule. For example, the \"TCP\" protocol is encoded as \"0x02\". Then, extract the source IP and destination IP from the rule and perform CIDR conversion. Through the combination of masks and prefix codes, both precise IP addresses and CIDR-format IP address sets can be converted one-to-one to obtain a 32-bit base address and 16-bit mask length. The source IP and destination IP are stored in two separate CIDR tables. If entries duplicate previous content, merging is required. Finally, based on the CIDR addresses in the two tables, store them in the rule table in the format \"SID_sourceCIDR_destCIDR\" (48 bits total). This completes the protocol and IP address compilation, finalizing the five-tuple rule compilation. After completing the five-tuple rule compilation, the system enters the fast-pattern compilation phase. Since nearly 70% of data packets require fast-pattern detection, the compilation quality of this module directly affects system throughput and detection accuracy,  
Figure 4: Port compilation process. Figure 5: Protocol and IP compilation process. posing significant challenges to compiler design.