# Design of a Heterogeneous-Based Network Intrusion Detection System and Compiler
## 3 Materials and Methods
### FPGA-Based Pre-Filtering Design  
In network environments, anomalous traffic typically exhibits specific characteristics such as IP addresses and payload fields. Such traffic can be intercepted through configured firewall policies and customized rules. Compared to traditional CPU-based network traffic processing solutions, the FPGA-based Pre-Filtering module implements anomaly data screening through predefined rules, significantly improving system matching performance with lower resource consumption. Simultaneously, this module serves as a preprocessing entry point to stably receive high-throughput network traffic, reducing system dependency on NIC and CPU performance, thereby enhancing overall operational efficiency. To achieve end-to-end packet processing and detection, the FPGA-based Pre-Filtering module comprises the following three components:  
Figure 1: Based on heterogeneous IDS system architecture. **Ethernet Module:** Implements external network connectivity via Ethernet, receiving and parsing incoming traffic. It extracts five-tuple information and packet payloads before transmitting them to the Rule Pre-Filtering module. **Rule Pre-Filtering Module:** Employs a dual-circuit architecture combining five-tuple matching and fast-pattern matching. It performs anomaly detection on input data, filters matched packets with associated rule IDs, and forwards them to the PCIe module. **PCIe Module:** Transmits rule-matched packets to the CPU-side Snort system for deep verification through a PCIe Gen3 x8 interface. It also enables control information exchange between the host and FPGA via PCIe drivers. Design of the Rule Pre-Filtering Module  
The Rule Pre-Filtering module consists of two components: five-tuple matching and fast-pattern matching, which collaboratively implement traffic pre-filtering. Five-tuple matching primarily processes the five-tuple information (source IP address, destination IP address, source port number, destination port number, and transport protocol) of IP packets within Ethernet frames. Since the five-tuple determines the session to which a packet belongs, it is defined as a core component of rules in network intrusion detection systems for identifying anomalous traffic. Fast-pattern matching performs payload detection on packets that pass five-tuple matching. Significant redundancy exists in the five-tuples of Snort rules--among the thousands of the Snort rules, there are only about 200 distinct header rules [37]. Consequently, a single five-tuple may correspond to multiple fast-pattern strings across different rules, necessitating secondary payload matching against the pattern strings of all matched rules. Figure 2 illustrates the detailed architecture of the Rule Pre-Filtering module:  
**A. Five-tuple Matching. ** The five-tuple matching module is partitioned into two subunits: port matching and protocol/IP matching. We adopted the \"port-separated\" matching strategy, which prioritizes port matching at the initial stage and eliminates cross-port hit correlation analysis. Instead, each data packet is divided into two segments for source port and destination port matching. Packet hits are determined by the SID corresponding to the matched ports, bypassing rule ID identification and directly outputting hit-confirmed packet indices to the fast-pattern matching module. This approach significantly improves  
Figure 2: Data processing workflow for the Rule Pre-Filtering module. the execution efficiency of the five-tuple matching module. The detailed matching workflow is structured as follows:  
The source/destination ports are first analyzed to determine the rule matching scope. After retrieving the rule IDs, they are sent to the protocol/IP matching module, which queries the corresponding source/destination IP CIDR tables based on protocol type and rule ID, then performs IP matching.