# Design of a Heterogeneous-Based Network Intrusion Detection System and Compiler
## 5 Results and Discussion
### System Performance  
Table 7 records the accuracy of the FPGA + Snort system under near-100 Gbps traffic with 2000, 6000, and 10,000 rules at a 5% anomaly ratio. Accuracy decreases as rule counts grow due to a design limitation in the rule compiler: fixed memory allocation during compilation increases hash collision probabilities. To prevent mismatches, the compiler forcibly discards colliding rule fields, causing rule data loss and missed detections, thereby reducing accuracy. Table 8 shows the throughput of Snort3 with 24 cores across rule sets. Accuracy remains 100% because predefined anomalies are guaranteed to trigger rules. Lower throughput arises because Snort alone handles traffic reception, parsing, and forwarding alongside rule matching. In contrast, the FPGA + Snort system offloads reception, parsing, and forwarding to the FPGA, allowing Snort to focus on rule matching using PCIe-transmitted packet segments and rule IDs, thereby significantly boosting throughput and core utilization. To validate 100 Gbps line-rate capability, we leveraged the Intel Stratix 10 SX2800's four 100 G optical ports. An additional traffic reception port was added, allocating 1.5 Gbps for transmission tasks. A new aggregation module was integrated into the FPGA design to test dual-port throughput and accuracy. Figures 10 and 11 confirm that the system achieves 100 Gbps throughput with over 97% accuracy across all three rule sets. This demonstrates that the performance of the compiler and Pre-Filtering module meets the requirements for normal operational environments. Compared to software-only Snort, the FPGA + Snort system delivers 10.5x, 15.4x, and 27.1x throughput improvements for 2000, 6000, and 10,000 rules, respectively, at a marginal accuracy trade-off. The aforementioned data reflect the performance comparison between the proposed system and the software-based Snort. As summarized in Table 9 this study conducts a performance comparative analysis between the proposed system and industry-related architectures (Pigasus and Fidas, both employing FPGA + CPU architectures). The evaluation metrics include rule capacity, regular expression matching support, compiler configurations, resource utilization, and packet loss onset  
It is imperative to note that the experimental data for the proposed system, Pigasus, and Fidas were obtained under divergent datasets and rule set conditions, with non-identical deployment hardware and configurations. Consequently, performance evaluation based on these results cannot yield precisely quantified comparative metrics across the systems. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Rule Set** & **Number of Rules** &
\begin{tabular}{c} **Throughput** \\ **(Gbps)** \\ \end{tabular} & **Accuracy (\%)** \\ \hline Custom rule sets & 2000 & 98.92 & 99.76 \\ snortrules-6000 & 6000 & 98.95 & 99.04 \\ snortrules-10000 & 10,000 & 98.87 & 97.47 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Throughput and accuracy of FPGA Snort system at 98 Gbps. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Rule Set** & **Number of Rules** &
\begin{tabular}{c} **Throughput** \\ **(Gbps)** \\ \end{tabular} & **Accuracy (\%)** \\ \hline Custom rule sets & 2000 & 8.72 & 100 \\ snortrules-6000 & 6000 & 6.13 & 100 \\ snortrules-10000 & 10,000 & 3.57 & 100 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Maximum throughput measured by Snort to ensure the normal operation of the system. As evidenced by the tabulated data, Pigasus and the proposed system exhibit suboptimal resource utilization due to their shared design choice of excluding regular expression matching from FPGA deployment, yet both support over 10,000 rules. Regarding packet loss metrics, Pigasus and Fidas demonstrate superior performance in small-packet processing compared to the proposed system.