Abstract: A system-on-a-chip (SoC) and corresponding method implement an intrusion detection system. The SoC comprises a traffic scanner that produces feature information associated with non-payload content of encrypted packets in a received traffic stream that cannot be decrypted by the SoC. The SoC further comprises a machine learning (ML) engine that (i) assigns a classification to the received traffic stream based on the feature information produced and (ii) based on the classification assigned, provides notification to the traffic scanner that malware traffic has been detected in the traffic stream. The traffic scanner further performs, based on the notification provided, an action toward preventing malicious activity otherwise caused by malware traffic.

Abstract: A system-on-a-chip (SoC) and corresponding method implement an intrusion detection system. The SoC comprises a plurality of hardware engines. The SoC employs the plurality of hardware engines to implement the intrusion detection system. The intrusion detection system is capable of detecting malware traffic in (i) a non-encrypted traffic stream, (ii) an encrypted traffic stream that can be decrypted by the SoC, and (iii) an encrypted traffic stream that cannot be decrypted by the SoC. The intrusion detection system performs an action responsive to detecting the malware traffic. The action is performed toward preventing malicious activity otherwise caused by the malware traffic.

Abstract: Aspects of the disclosure provide a network device. The network device includes a search engine, a ternary content addressable memory (TCAM) cache engine, a search key generation unit and an output controller. The search engine stores a lookup table of entries for rules of packet processing, and searches the lookup table in response to packets received from a network interface of the network device. The TCAM cache engine caches a subset of the entries in the lookup table based on hit statistics of the entries. The search key generation unit generates a search key based on a received packet and provides the search key to the search engine and to the TCAM cache engine. The output controller outputs a search result from the TCAM cache engine when the TCAM cache engine has a matching entry to the search key.

Abstract: Aspects of the disclosure provide a network device. The network device includes a search engine, a ternary content addressable memory (TCAM) cache engine, a search key generation unit and an output controller. The search engine stores a lookup table of entries for rules of packet processing, and searches the lookup table in response to packets received from a network interface of the network device. The TCAM cache engine caches a subset of the entries in the lookup table based on hit statistics of the entries. The search key generation unit generates a search key based on a received packet and provides the search key to the search engine and to the TCAM cache engine. The output controller outputs a search result from the TCAM cache engine when the TCAM cache engine has a matching entry to the search key.

Abstract: A system and a method of the present invention for implementing a combined use Timer_CU within an ATM transmitter. The ATM transmitter being able to handle a plurality of ATM channels, at least one of the channel being an ATM AAL2 channel. The ATM channels can provide ATM-cells at different traffic parameters, such as, for example, different cell or bit rate, priorities, and bursts. The system schedules channels in a first table by channel identifiers. Cyclical pointers to this first table advance (i) at every time slot, (ii) within a time slot, whereas (iii) CPS-Packets with one or more octets already packed wait at most the duration of a Timer_CU before being scheduled to be sent by CPS transmitter to ATM transmitter. Conveniently, the schedule scheme is based upon a scheduling table comprising of a plurality of time slots.