# Design of a Heterogeneous-Based Network Intrusion Detection System and Compiler
## 4 Deployment of Experimental Environment  
### Platform Construction  
In this section, we design an experimental environment to evaluate the performance of our system. The FPGA-side development, synthesis, and downloading are implemented based on Quartus 23.4, with the hardware program deployed on an Intel Stratix 10 SX2800 series board and the software running on an Intel(R) Xeon(R) CPU E5-2696. As illustrated in Figure 7, the experimental environment consists of two parts: traffic generation and testing system. The traffic generation part comprises two 100 GbE Mellanox ConnectX-5 NICs. Since a single NIC cannot achieve stable bidirectional 100 GbE transmission, two NICs are \begin{table}
\begin{tabular}{l c c c} \hline
**File Name** & **Depth** & **Width** & **File Size** \\ \hline Port Table & 16,384 & 32 & 512 Kb \\ Port Rule Table & 16,384 & 16 & 256 Kb \\ CIDR Table (2 × 4) & 8192 & 48 & 384 Kb \\ Five-tuple rule Table & 16,384 & 48 & 768 Kb \\ Hash Bitmap Table (8) & 256–4096 & 8 & 2 Kb–32 Kb \\ Rule Mapping Table (8) & 512–16,384 & 16 & 8 Kb–256 Kb \\ Shift-or Mask Table & 16,384 & 64 & 1 Mb \\ \hline \end{tabular}
\end{table} 
Table 4: Rule feature statistics. \begin{table}
\begin{tabular}{c c c c c} \hline
**Char** & **ASCII** & **Offset** & **The Lower 5 bits of the Next Character** & **Index** \\ \hline G & 0x47 & 4 & 0x09 & 0x0947 \\ i & 0x69 & 3 & 0x1A & 0x1A69 \\ z & 0x7A & 2 & 0x0D & 0x0D7A \\ m & 0x6D & 1 & 0x0F & 0x0F6D \\ o & 0x6F & 0 & / & 0x006F-0x1F6F \\ \hline \end{tabular}
\end{table} 
Table 3: Shift-or compilation table of “Gizmo”. configured to handle sending and receiving separately. By providing the CIC IDS2017 dataset [42] and custom pcap file templates, Pktgen generates 100 GbE traffic and transmits it through the NIC ports. Due to the inability of a single port to meet performance metrics, part of the receiver's resources is allocated for transmission. In the system under test, the FPGA chip model is Intel Stratix 10 SX2800 with 2753k logic elements (LEs) and 229 Mb M20K memory. The CPU on the software side is an Intel(R) Xeon(R) E5-2696, containing 2 sockets with 22 cores each (88 logical CPUs). The FPGA and CPU are connected via a PCIe Gen 3 x 8 interface for data transfer. Building upon the experimental environment described, this test deploys two NICs to collaboratively transmit 100 Gbps of suspicious traffic into the target system, aiming to evaluate the intrusion detection performance of the proposed system. By analyzing the packet count received by the destination NIC and Snort-printed anomaly data, the system's true accuracy rate and throughput performance are calculated through comparison with predefined anomaly traffic datasets. Concurrently, the system's overall performance is validated by benchmarking against software-only Snort and industry-standard architectures with analogous designs. We test the system using three rule sets of varying scales while evaluating the practical performance of the rule compiler. The custom rule set contains manually selected and authored rules, while the other two are derived from the snortrules-snapshot-3180 rule set through pruning. Table 5 lists details of the three rule sets, including rule counts, maximum/minimum fast-pattern lengths, and average lengths, ensuring broad coverage suitable for evaluating the proposed heterogeneous NIDS and compiler. Table 6 shows the FPGA resource utilization when supporting 10,000 rules. The resource occupancy confirms that the system can be fully configured and operated on the FPGA board. Based on our experimental setup, the software component requires only 24 logical cores to handle 10,000 rules under 100 Gbps traffic. Thus, 24 logical cores are used for subsequent comparative experiments.