Hybrid Energy-Aware Multi-Match Network Intrusion Detection System (HEAMC-NIDS)

Network Intrusion Detection Systems (NIDS) depend on accurate and high-speed packet inspection to detect malicious activity. The increasing size of Snort databases and rising network line rates challenge existing solutions, which often compromise either throughput or energy efficiency. None of the prior works have focused on integrating packet classification along with payload matching. They have optimized multi-match classification using TCAMs, rule layering, or prefix-based segmentation in payload matching, but each suffers from scalability and power consumption limitations. This paper proposes a Hybrid Energy-Aware Multi-Match NIDS (HEAMC-NIDS) thatintegrates prefix-segmented TCAM architecture, layered rule compression, and bit-map assisted aggregation for efficient signature detection. The design activates only one TCAM block per lookup, drastically reducing matchline switching and power consumption. Analytical modeling and FPGA simulation show that HEAMC-NIDS achieves 150 Gbps throughput, 90% energy reduction, and up to 70% memory savings compared with existing TCAM-based NIDS implementations.