Automatic Construction of Hardware Traffic Validators


  • Stephen Taylor Thayer School of Engineering at Dartmouth
  • Jason Web Sensing, LLC.
  • Ellie Dartmouth College
  • Brandon Dartmouth College



parsing, LALR grammar, traffic validation, FPGA, Bison, Hammer.


This paper describes a fully automated process that creates a custom hardware traffic validator directly from a formal grammar and deploys it within a specialized network security appliance. The appliance appears as a hidden, all-hardware “bump-in-the-wire” that can be inserted within any network segment; it stores and validates messages on-the-fly, and either forwards or drops individual packets in real-time. Consequently, it serves to disrupt and mitigate stealthy remote attacks that leverage zero-day exploits and persistent implants. Allowed traffic, files, and mission payload formats are specified formally using a standard Look-Ahead, Left-to-Right (LALR) grammar that operates on ASCII and/or binary data. The grammars can be expressed either in Backus-Naur Form (BNF), used by industry standard tools such as Bison, or through state-of-the-art combinators, such as Hammer, under development within the DARPA SafeDocs program. Bison and Hammer compiler tools are used to generate standard shift/reduce parsing tables. These tables are post-processed to improve their compactness and practical viability. The optimized tables are then combined with a generic push-down automaton to form a complete parser. The parser is then automatically transformed into a hardware circuit using High-Level Synthesis (HLS). The result is a composable block of circuitry that can be directly inserted into a generic communications harness embedded within a Field Programmable Gate Array (FPGA) on the network appliance.

Author Biographies

Jason, Web Sensing, LLC.

Managing Partner

Ellie, Dartmouth College

Student, Thayer School of Engineering at Dartmouth College

Brandon, Dartmouth College

Student, Thayer School of Engineering at Dartmouth College