A TCAM-based solution for integrated traffic anomaly detection and policy filtering

Zhijun Wang, Hao Che, Jiannong Cao, Jingshan Wang

Research output: Journal article publicationJournal articleAcademic researchpeer-review

5 Citations (Scopus)


The survivability of the future Internet is largely dependent on whether it will be able to successfully address both security and performance issues facing the Internet. On one hand, the Internet becomes more and more vulnerable due to fast spreading malicious attacks. On the other hand, it is under great stress to meet ever growing/changing application demands while having to sustain multi-gigabit forwarding performance. In this paper, we propose a Ternary Content Addressable Memory (TCAM) coprocessor based solution for high speed, integrated TCP flow anomaly detection and policy filtering. The attacking packets with spoofed source IP addresses are detected through two-dimensional (2D) matching. The key features of the solution are: (1) setting flag bits in TCAM action code to support various packet treatments; (2) managing TCP flow state in pair to do 2D matching. We evaluate the solution's ability to detect TCP-based flooding attacks based on real-world-trace simulations. The results show that the proposed solution can match up OC-192 line rate. The possible modifications of the solution for the detection of low rate TCP-targeted attacks are also discussed.
Original languageEnglish
Pages (from-to)1893-1901
Number of pages9
JournalComputer Communications
Issue number17
Publication statusPublished - 15 Nov 2009


  • Flow anomaly detection
  • TCAM coprocessor
  • Two-dimensional matching

ASJC Scopus subject areas

  • Computer Networks and Communications


Dive into the research topics of 'A TCAM-based solution for integrated traffic anomaly detection and policy filtering'. Together they form a unique fingerprint.

Cite this