Michael Attig's Homepage

Welcome to my skeletal, no-frills webpage. Below you will find information about my research interests, publications, past projects, graduate courses completed, and contact info.

I was a Master's student in the Department of Computer Science and Engineering at Washinton University (in St. Louis).
My research advisor was Dr. Lockwood. My research interests were and still are:

• Parallel Computing
• Simplifying FPGA Design implementations
• Methods for reconfigurable computing
• Adding intelligence into the network infrastructure
• Characterizing Traffic flows
• Providing ways to automatically detect flow characteristics and react
• Providing Network Security

Current Projects

• None at WashU.
• I am now at Xilinx.

Publications

• FPL 2005: Snort Offloader: A Reconfigurable Hardware NIDS Filter (paper and bibtex)
• HotI 2005: SIFT: Snort Intrusion Filter for TCP (paper, slides, and bibtex)
• FCCM 2005: A Framework for Rule Processing in Reconfigurable Network Systems (paper, slides, and bibtex)
• IEEE Aerospace Conference 2005: Transformation Algorithms for Data Streams (paper and bibtex)
• FCCM 2004: Implementation Results of Bloom Filters for String Matching (paper, poster, and bibtex)

Technical Reports

• Thesis: Architectures for Rule Processing IDPS (paper and slides)
• Design and Implementation of a String Matching System for Network Intrusion Detection using FPGA-based Bloom Filters (tech report)
• Statistics Counter Plus (tech report)
• Pipelined Control Cell Processor (tech report)
• Statistics Counter (tech report)

Past Projects

• XML Meta-data generation
• SIFT
• Flow-based Rule Processing
  • Features
    1. 3 Components: Header processor, Content Processor, Rule Processor
    2. Operates at over 2.5 Gbps
    3. Able to hold/process over 32,000 rules
    4. Add/Delete/Edit a Rule instantly
    5. Can alert, alert/return, drop, drop/return packets that have rule match
• Flow-based QoS using Content-scanning
  • Reconstruct TCP Flows
  • Perform Deep-packet inspection
  • Based on Search criteria, modify Diffserv field for rest of TCP flow
  • Support for 1/2 million flows
  • Scan for up to 8500 strings at over 2.5 Gbps
• Snort Lite - An Intrusion Detection and Prevention System (IDPS)
  • Overview Slides (ppt)
  • Features
    1. Scans every byte of every packet at 500 Mbps per engine (4 engines = 2 Gbps)
    2. Combines deep-packet inspection with header processing
    3. Holds 1419 unique signatures (fixed length) per engine
    4. Can fit 25 different engines in the VirtexE 2000 FPGA
    5. Supports up to 35,475 snort-like rules in a single VirtexE 2000 FPGA
    6. Add/Delete/Edit a Rule in Microseconds.
    7. Can selectively drop, alert, or return offending packets
    8. Ability to operate with ATM, OC-48, or Gigabit Ethernet framed IP packets
• Statistics Module
• Statistics Graphing Application

Current Courses

• None!

Graduate Courses Completed

• CoE 521: Computer Architecture (Fall 2002)
• CS 541T: Algorithms and Programs (Fall 2003)
• CoE 535M: Acceleration of Algorithms in Reconfigurable Hardware (Fall 2003)
• CS 573S: Protocols for Computer Networks (Spring 2004)
• CoE 579M: Parallel Architectures (Spring 2004)
• CS 511A: Artificial Intelligence (Fall 2004)
• CoE 566: Reconfigurable System-on-Chip (Fall 2004)
• CoE 577: Switching Systems (Fall 2004)
• CoE 561: Computer Architecture II (Spring 2005)

Industry Experience

Contact Info:

• Email: mea 'the number ONE' at arl.wustl.edu
• or mike dot 'my last name' at xilinx.com