# Design of a Heterogeneous-Based Network Intrusion Detection System and Compiler
## Appendix A Anomaly-Based Heterogeneous Intrusion Detection  
Anomaly-based heterogeneous IDS employ FPGA, GPU, or other computing platforms to construct heterogeneous architectures. These systems integrate machine learning and deep learning algorithms for model training on the platforms, establishing behavioral baselines to evaluate network behavior deviations and detect both known and unknown anomalies. [PERSON] et al. (2018) designed a CPU + FPGA-based convolutional neural network for IDS, demonstrating significant improvements in power consumption, energy efficiency, and performance compared to software implementations through platform deployment and training. [PERSON] et al. (2019) proposed a collaborative anomaly traffic detection system that deploys Bloom filters on \begin{table}
\begin{tabular}{l c c l} \hline \hline
**Direction** & **NO.** & **Year** & **Characteristics** \\ \hline \multirow{8}{*}{Anomaly 1} & [19] & 2024 & The dual-metric integrated feature selection process is utilized to reduce computational complexity and improve classification accuracy, with the scheme demonstrating low resource utilization. \\  & [20] & 2023 & Through continued optimization of hardware energy efficiency, the number of executable operations per unit power consumption can be significantly increased. \\  & [21] & 2023 & The FPGA-based frequency transformation feature extraction and CPU-based AF-Packet and ring buffer feature capture achieve real-time detection with an accuracy rate of approximately 0.98. \\  & [22] & 2023 & The optimized design increases effective throughput while maintaining lower FPGA resource utilization. \\  & [23] & 2022 & The system adopts a high-performance, ultra-low-power pipelined design, achieving a 53.5 times speed increase at 100 MHz. \\  & [24] & 2022 & A feature engineering processor for data dimensionality reduction has been designed, which reduces the average loss value of data with minimal resources. \\  & [25] & 2009 & Efficient hardware architecture and rapid memory caching mechanism enhance system performance. \\ \hline \multirow{8}{*}{Signature 2} & [12] & 2024 & The system utilizes PF\_RINC, DPDK, and smartNIC to achieve near-1G throughput, with system integration with SEM also discussed. \\  & [17] & 2024 & The integration of Bloom filters with TCAM enables faster filtering speeds using less memory, with total system throughput reaching up to 128 Gbps. \\  & [13] & 2022 & Fifals employs multi-stage filtering to process regular expressions, and the dual-stack storage scheme identifies hot flows, achieving advanced throughput in pattern matching and flow rate classification. \\  & [26] & 2022 & A DFA compression and regular expression decomposition scheme is proposed to address DFA state explosion, achieving 6.33 Gbps matching throughput on Snort rule sets. \\  & [27] & 2021 & A solution maintaining stable and high operating frequencies at the cost of resource usage is proposed, achieving over 17 Gbps throughput. \\  & [28] & 2020 & An NIDS-style packet hardware filter has been designed, exhibiting low-cost and high-flexibility characteristics. \\  & [15] & 2020 & Pigusus utilizes an average of five CPU cores and one FPGA to support 100 Gbps throughput, 10K+ rules, and 100K+ concurrent flows. \\  & [29] & 2019 & The system employs an FPGA-based DPI implementation applicable to 100 Gbps and higher DPI task realizations. \\  & [30] & 2016 & An FPGA-based multi-core architecture is proposed, enabling collaborative DDoS mitigation techniques to classify input data, ultimately achieving 100\% detection rate, 0% false negative rate, and maximum data throughput of 19.738 Gbps. \\  & [14] & 2008 & Gnort utilizes GPU offloading for pattern matching, and synthetic network tracing achieves a maximum throughput of 2.3 Gbps. \\ \hline \hline \end{tabular} \({}^{1}\) Anomaly-based IDS. 2 Signature-based IDS.  
\end{table} 
Table 1: Research on heterogeneous network intrusion detection.