# Design of a Heterogeneous-Based Network Intrusion Detection System and Compiler
## 1 Introduction  
As a core component of network security protection systems [1, 2], NIDS performs critical functions in identifying and defending against malicious activities through real-time traffic analysis. Based on detection mechanisms, existing IDS can be categorized into anomaly-based IDS and signature-based IDS: the former detects deviations by establishing baseline models of network behaviors [3], offering advantages in detecting unknown attacks but suffering from high false positive rates and substantial computational overhead; the latter (e.g., Snort [4]) relies on predefined rule features for precise matching [5], delivering high detection efficiency and low false positives, yet faces limitations in rule database scalability and maintenance costs. Numerous researchers have proposed various network intrusion detection systems based on these characteristics. These systems optimize detection algorithms [6, 7, 8, 9, 10] and deploy heterogeneous architectures with parallelized hardware [11; 12; 13; 14; 15] to accelerate anomaly detection, thereby effectively improving system throughput and detection accuracy. For instance, [PERSON] et al. [6] developed a hybrid convolutional neural network and bidirectional long short-term memory network to enhance system performance through binary and multiclass classification. [PERSON] et al. [7] integrated machine learning with a multiprocessor system for parallel packet analysis, significantly improving detection accuracy. [PERSON] et al. [8] migrated partial Snort functionalities to the Linux kernel, leveraging eBPF for fast-pattern matching to boost overall system throughput. [PERSON] et al. [11] combined deep learning with FPGA-based hardware acceleration, achieving low-latency, high-throughput processing while enabling lightweight architecture scalability based on network bandwidth. [PERSON] et al. [12] utilized PF_RING and DPDK to achieve near-1G throughput, employing smart network interface cards to guarantee line-rate traffic processing. [PERSON] et al. [13] implemented efficient regular expression-processing filters on FPGAs, enabling pattern matching and flow classification in IDS systems under 100 Gbps networks. However, the aforementioned designs still exhibit three major limitations:  
**(1) Software throughput constraints:** CPU-based software solutions struggle to surpass the 100 Gbps processing bottleneck [6; 7; 9];  
**(2) Simplistic hardware offloading:** Existing acceleration schemes primarily focus on optimizing specific modules, lacking system-level collaborative design [16; 17];  
**(3) Imperfect rule compilation:** Hardware acceleration platforms inadequately support complex rule sets, limiting the scale of deployable rules in practice [13; 15; 18]. To address these challenges, this paper proposes a \"heterogeneous collaborative processing + rule hierarchical compilation\" strategy. By implementing FPGA-based hardware preprocessing for coarse-grained traffic filtering and CPU-based software for precise verification, a software-hardware collaborative detection system is established. The specific design comprises the following:  
**(1) Heterogeneous IDS Architecture:** The FPGA serves as a 100 Gbps traffic reception and forwarding port, significantly enhancing the system's traffic handling capacity. Simultaneously, the system fully leverages the respective advantages of software and hardware by deploying different matching modules to collaboratively complete anomaly detection tasks. **(2) Software-Hardware Cooperative Matching Algorithm and Design:** On the FPGA side, a five-tuple segmented matching architecture integrates hash bitmap and shift-or algorithms to implement first-round traffic filtering. On the CPU side, suspicious data are received and consolidated to complete full-rule matching and issue control commands. **(3) High-Efficiency Rule Compiler:** Supports 10,000 Snort rules, employing group optimization and mask compilation techniques to improve hardware adaptability.