# Design of a Heterogeneous-Based Network Intrusion Detection System and Compiler
## 6 Conclusions and Future Work  
This paper presents a heterogeneous NIDS and its rule compiler, supporting diverse scenarios and rule scales. Our rule compiler adapts to custom and Snort community rule sets, scaling beyond 10,000 rules--surpassing most existing heterogeneous NIDS in rule support and applicability. The FPGA-based IDS achieves 100 Gbps line-rate operation with 97%+ accuracy at 700 B average packet size and \(<\)5% anomaly ratio, consuming only 33% logic resources. Compared to state-of-the-art designs like Pigasus [15] and Fidas [13],our compiler enhances portability, compatibility, and practicality across network environments and hardware deployments.  
While the heterogeneous network intrusion detection system and its rule compiler proposed in this paper have achieved significant improvements in throughput and rule compatibility, there are still three key directions requiring further optimization. First, in terms of detection accuracy, the current system's 97% accuracy still has room for improvement compared to signature-based software IDS, and algorithmic optimization of the rule compiler will be the primary focus for enhancing detection accuracy in subsequent work. Second, at the system architecture level, although dynamic rule compilation and deployment has become a mainstream design paradigm for heterogeneous architectures, our system currently still requires rule set replacement through recompilation and board reprogramming. In the future, we plan to achieve compatibility for this functionality by coordinating hardware-software configurations to shorten deployment cycles and support dynamic synchronous rule updates. Additionally, the current system design does not incorporate any system protection mechanisms, implying that any targeted attacks or operations exceeding system thresholds may result in complete system failure and loss of intrusion detection capability. Future work will focus on implementing system protection mechanisms, establishing optimized protective measures, and deploying emergency response modules to enhance system robustness. Finally, regarding filtering mechanism optimization, the current system only uses the \"fast-pattern\" in rules for traffic filtering. Future work will focus on expanding the adaptation scope of rule file fields to enhance the filtering precision and execution efficiency of the FPGA Pre-Filtering module, which will form the core research direction for subsequent investigations.  
**Author Contributions:** Conceptualization, Z.L., J.C. and X.Z.; methodology, Z.L., J.C., X.Z. and Q.L.; software, X.Z.; validation, Z.L., X.Z. and Q.L.; formal analysis, Z.L., J.C. and Q.L.; investigation, X.Z.; resources, Q.L.; data curation, Z.L., J.C., X.Z. and Q.L.; writing--original draft preparation, Z.L., J.C., X.Z. and Q.L.; writing--review and editing, Z.L., J.C. and Q.L.; visualization, Z.L. and X.Z.; supervision, Z.L., J.C. and Q.L.; project administration, Z.L., J.C. and Q.L.; funding acquisition, Q.L. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This research received no external funding.  
**Data Availability Statement:** The data presented in this study are available in Section 5.  
**Conflicts of Interest:** The authors declare no conflicts of interest.